Add patch to move hexdump check to function that

requires it #65

Makefile

@@ -12,7 +12,7 @@ VERSION=	$(shell git tag --sort=taggerdate | tail -1)
 # Prevent macOS from putting resource forks in the tar
 export COPYFILE_DISABLE=true
 
-.PHONY: archive release subclean
+.PHONY: archive patch release subclean
 archive: $(ARCHIVE)
 
 release: clean .version $(ARCHIVE)
@@ -22,7 +22,7 @@ release: clean .version $(ARCHIVE)
 	echo "$(VERSION)" > $@
 	git rev-parse HEAD 2>/dev/null >> $@
 
-$(ARCHIVE): clean $(SCRIPT) .version
+$(ARCHIVE): clean $(SCRIPT) patch .version
 	find . -type f \
 	    -not -path '*/.git/*' \
 	    -not -name '.git*' \
@@ -34,6 +34,12 @@ $(ARCHIVE): clean $(SCRIPT) .version
 $(SCRIPT):
 	git submodule init && git submodule update
 
+# This is a temporary hack to work around an upstream bug. We want a better
+# way to handle this.
+# https://github.com/dehydrated-io/dehydrated/issues/910
+patch: $(SCRIPT)
+	patch -p1 $< < PATCHES/000-fix-hexdump-check.patch
+
 subclean:
 	git submodule foreach --recursive git reset --hard
 

PATCHES/000-fix-hexdump-check.patch

@@ -0,0 +1,22 @@
+diff --git a/dehydrated b/dehydrated
+index a170666..19a2e49 100755
+--- a/dehydrated
++++ b/dehydrated
+@@ -260,7 +260,7 @@ _mktemp() {
+ # Check for script dependencies
+ check_dependencies() {
+   # look for required binaries
+-  for binary in grep mktemp diff sed awk curl cut head tail hexdump; do
++  for binary in grep mktemp diff sed awk curl cut head tail; do
+     bin_path="$(command -v "${binary}" 2>/dev/null)" || _exiterr "This script requires ${binary}."
+     [[ -x "${bin_path}" ]] || _exiterr "${binary} found in PATH but it's not executable"
+   done
+@@ -686,6 +686,8 @@ init_system() {
+
+     # ZeroSSL special sauce
+     if [[ "${CA}" = "${CA_ZEROSSL}" ]]; then
++      bin_path="$(command -v "hexdump" 2>/dev/null)" || _exiterr "This script requires hexdump."
++      [[ -x "${bin_path}" ]] || _exiterr "hexdump found in PATH but it's not executable"
+       if [[ -z "${EAB_KID:-}" ]] ||  [[ -z "${EAB_HMAC_KEY:-}" ]]; then
+         if [[ -z "${CONTACT_EMAIL}" ]]; then
+           echo "ZeroSSL requires contact email to be set or EAB_KID/EAB_HMAC_KEY to be manually configured"