the wry host is optional through the whole pipeline; it must not block sessiond

.gitea/workflows/ci.yml

@@ -160,10 +160,20 @@ jobs:
           # The wry host: self-hosted sites as apps, and the rig she wears.
           # Needs webkit2gtk on the build sysroot; it is already installed on
           # the phone (TASK-59 phase 1 measured against it).
-          ./scripts/build-cross.sh --features web --bin souveraine-web
+          # Best effort: it links against the system webview, so it needs
-          WBIN="$CARGO_TARGET_DIR/aarch64-unknown-linux-gnu/release/souveraine-web"
+          # webkit2gtk in the aarch64 sysroot. Until that is there this is the
-          file "$WBIN" | grep -q aarch64 || { echo "web host is not aarch64" >&2; exit 1; }
+          # one binary that may legitimately not build, and it must not stop the
-          cp "$WBIN" souveraine-web-aarch64
+          # ones that decide whether the phone locks.
+          if ./scripts/build-cross.sh --features web --bin souveraine-web; then
+            WBIN="$CARGO_TARGET_DIR/aarch64-unknown-linux-gnu/release/souveraine-web"
+            if file "$WBIN" | grep -q aarch64; then
+              cp "$WBIN" souveraine-web-aarch64
+            else
+              echo "::warning::web host built but is not aarch64; skipping it"
+            fi
+          else
+            echo "::warning::the wry host did not cross-build (webkit2gtk sysroot?); skipping it"
+          fi
 
           # secrets rail + machined: also hand-copied on the phone until now.
           ./scripts/build-cross.sh --features secrets --bin souveraine-secrets
@@ -208,7 +218,6 @@ jobs:
 
           sha256sum souveraine-aarch64 souveraine-x86_64 \
             souveraine-sessiond-aarch64 souveraine-sensord-aarch64 \
-            souveraine-web-aarch64 \
             souveraine-secrets-aarch64 souveraine-secrets-x86_64 \
             souveraine-machined-aarch64 souveraine-machined-x86_64 \
             souveraine-sessiond-x86_64 \
@@ -366,6 +375,14 @@ jobs:
               cp packaging/souveraine-sessiond.service "$PKG_WORK/"
               cp "souveraine-sensord-$ARCH" "$PKG_WORK/souveraine-sensord-binary"
               cp packaging/souveraine-sensord.service "$PKG_WORK/"
+              # The wry host. Guarded, and the PKGBUILD source line is removed
+              # when it is absent: it needs webkit2gtk in the aarch64 sysroot,
+              # and a missing avatar must not stop sessiond reaching the phone.
+              # makepkg validates every entry in `source`, so leaving a name
+              # there with no file fails the whole package.
+              if [ -f "souveraine-web-$ARCH" ]; then
+                cp "souveraine-web-$ARCH" "$PKG_WORK/souveraine-web-binary"
+              fi
             fi
             cp packaging/souveraine-verify-trail "$PKG_WORK/"
             cp packaging/souveraine-button "$PKG_WORK/"

packaging/arch/PKGBUILD.prebuilt

@@ -24,9 +24,17 @@ sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
 # rather than declaring them as sources for every arch.
 if [ "$CARCH" = aarch64 ]; then
     source+=('souveraine-sessiond-binary' 'souveraine-sessiond.service'
-             'souveraine-sensord-binary' 'souveraine-sensord.service'
+             'souveraine-sensord-binary' 'souveraine-sensord.service')
-             'souveraine-web-binary')
     sha256sums+=('SKIP' 'SKIP' 'SKIP' 'SKIP')
+    # The wry host links the system webview, so it only cross-builds once
+    # webkit2gtk is in the aarch64 sysroot. Declared only when CI actually
+    # produced one: makepkg validates every entry in `source`, so naming a file
+    # that is not there fails the entire package — and the avatar must never be
+    # what stops sessiond reaching the phone.
+    if [ -f "$startdir/souveraine-web-binary" ]; then
+        source+=('souveraine-web-binary')
+        sha256sums+=('SKIP')
+    fi
 fi
 
 package() {