hbsd-poudriere.sh

#!/bin/sh
pkg install -y poudriere ccache git-lite
mkdir /var/cache/ccache

# edit poudriere.conf
echo "cache_dir = /var/cache/ccache" >>/usr/local/etc/ccache.conf
echo "CCACHE_DIR=/var/cache/ccache" >> /usr/local/etc/poudriere.conf
echo "ZPOOL=zroot" >> /usr/local/etc/poudriere.conf

# add your poudriere.conf options below
echo "CHECK_CHANGED_OPTIONS=verbose" >> /usr/local/etc/poudriere.conf
echo "CHECK_CHANGED_DEPS=yes" >> /usr/local/etc/poudriere.conf
echo "NOLINUX=yes" >> /usr/local/etc/poudriere.conf

# create poudriere datasets, mountpoints and jail
zfs create -p zroot/poudriere/base/jails/11-STABLE
zfs set mountpoint=/poudriere zroot/poudriere
cd /poudriere/base/jails/11-STABLE
fetch -o /tmp/base.txz https://installer.hardenedbsd.org/pub/HardenedBSD/releases/amd64/amd64/hardenedbsd-11-stable-LAST/base.txz
tar xf /tmp/base.txz
poudriere jail -c -j 11-STABLE -m null -M /poudriere/base/jails/11-STABLE

# Some trickery to get the correct version strings to satisfy poudriere
mkdir -p /usr/local/etc/poudriere.d/jails/11-STABLE
echo "11.2-RELEASE" > /usr/local/etc/poudriere.d/jails/11-STABLE/version
echo 'UNAME_ENV+=     UNAME_s=FreeBSD' >> /usr/local/etc/poudriere.d/11-STABLE-current-make.conf
echo 'UNAME_ENV+=     UNAME_r=11.2-RELEASE' >> /usr/local/etc/poudriere.d/11-STABLE-current-make.conf
echo 'UNAME_ENV+=     UNAME_v="${UNAME_s} ${UNAME_r}"' >> /usr/local/etc/poudriere.d/11-STABLE-current-make.conf
echo '.MAKEFLAGS:     ${UNAME_ENV}' >> /usr/local/etc/poudriere.d/11-STABLE-current-make.conf
echo 'MAKE_ENV+=      ${UNAME_ENV}' >> /usr/local/etc/poudriere.d/11-STABLE-current-make.conf
echo 'CONFIGURE_ENV+= ${UNAME_ENV}' >> /usr/local/etc/poudriere.d/11-STABLE-current-make.conf
echo 'SCRIPTS_ENV+=   ${UNAME_ENV}' >> /usr/local/etc/poudriere.d/11-STABLE-current-make.conf

# Get HBSD ports tree and import it into poudriere
git clone https://github.com/HardenedBSD/hardenedbsd-ports.git /usr/ports
mkdir /usr/ports/distfiles
poudriere ports -c -p current -m null -M /usr/ports

# Relax security for package builds - as by @lattera on official build server
echo 'hardening.pax.aslr.status=1' >> /etc/sysctl.conf
echo 'hardening.pax.pageexec.status=1' >> /etc/sysctl.conf
echo 'hardening.pax.mprotect.status=1' >> /etc/sysctl.conf
echo 'hardening.procfs_harden=0' >> /etc/sysctl.conf
echo 'hardening.pax.disallow_map32bit.status=1' >> /etc/sysctl.conf
echo 'security.bsd.hardlink_check_gid=0' >> /etc/sysctl.conf
echo 'security.bsd.hardlink_check_uid=0' >> /etc/sysctl.conf
echo 'debug.debugger_on_panic=0' >> /etc/sysctl.conf

# Reboot to finish
shutdown -r now

Version file in line 26 was not written because the directory did not exist yet. Added line 25 to create the path.