packaging: sessiond ships on both arches, enabled on neither

CI already built the x86_64 daemon and then threw it away — the binary and
its user unit were copied into the package only under aarch64, so the
laptop could never receive the thing every lock, blank and button report
assumes is running.

Both now ship, and the package still neither enables nor starts the unit.
Phone-only reporters and surfaces stay aarch64.

.gitea/workflows/ci.yml

@@ -217,10 +217,9 @@ jobs:
           # button reporting all assume the daemon is there — so no session
           # authority on x86 means no viewtop on the laptop.
           #
-          # Building is not enabling. The binary ships; the user unit is
-          # aarch64-only in PKGBUILD.prebuilt and stays that way until the
-          # laptop path is actually tested, so this cannot wedge a laptop by
-          # arriving on it.
+          # Building and packaging are not enabling. The package-owned user
+          # unit ships on both architectures, but package installation neither
+          # enables nor starts it; target activation remains separately tested.
           cargo build --release --features sessiond --bin souveraine-sessiond
           B="$CARGO_TARGET_DIR/release/souveraine-sessiond"
           file "$B" | grep -q 'x86-64' || { echo "sessiond is not x86_64" >&2; exit 1; }
@@ -377,13 +376,13 @@ jobs:
             cp "souveraine-$ARCH" "$PKG_WORK/souveraine-binary"
             cp "souveraine-secrets-$ARCH" "$PKG_WORK/souveraine-secrets-binary"
             cp "souveraine-machined-$ARCH" "$PKG_WORK/souveraine-machined-binary"
+            cp "souveraine-sessiond-$ARCH" "$PKG_WORK/souveraine-sessiond-binary"
             cp packaging/souveraine.service packaging/souveraine-secrets.service \
                packaging/org.freedesktop.secrets.service \
-               packaging/souveraine-machined.service LICENSE "$PKG_WORK/"
-            # aarch64 only — see the sessiond note in the build step.
+               packaging/souveraine-machined.service \
+               packaging/souveraine-sessiond.service LICENSE "$PKG_WORK/"
+            # Phone-only reporters and surfaces remain aarch64-only.
             if [ "$ARCH" = aarch64 ]; then
-              cp "souveraine-sessiond-$ARCH" "$PKG_WORK/souveraine-sessiond-binary"
-              cp packaging/souveraine-sessiond.service "$PKG_WORK/"
               cp "souveraine-sensord-$ARCH" "$PKG_WORK/souveraine-sensord-binary"
               cp packaging/souveraine-sensord.service "$PKG_WORK/"
               cp "souveraine-usb-kvm-$ARCH" "$PKG_WORK/souveraine-usb-kvm-binary"
@@ -408,8 +407,9 @@ jobs:
             PKG=$(find "$PKG_WORK" -maxdepth 1 -name 'souveraine-*.pkg.tar.zst' -print -quit)
             test -n "$PKG"
             bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine'
+            bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine-sessiond'
+            bsdtar -tf "$PKG" | grep -qx 'usr/lib/systemd/user/souveraine-sessiond.service'
             if [ "$ARCH" = aarch64 ]; then
-              bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine-sessiond'
               bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine-usb-kvm'
             fi
             cp "$PKG" "$ARCH_REPO/"

Cargo.toml

@@ -171,8 +171,8 @@ aes-gcm = { version = "0.10", optional = true }
 argon2 = { version = "0.5", optional = true }
 
 # Session authority daemon (souveraine-sessiond) — ext-session-lock client.
-# Pure-Rust wayland stack; PAM is hand-rolled FFI against libpam (no new dep,
-# same reasoning as machined: fewer deps = fewer on-device build failures).
+# Pure-Rust Wayland stack. The daemon owns locking and the holding surface; it
+# deliberately has no unlock UI or PAM conversation (`src/sessiond/lock.rs`).
 wayland-client = { version = "0.31", optional = true }
 wayland-protocols = { version = "0.32", optional = true, features = ["client", "staging"] }
 wry = { version = "0.56.0", optional = true }

packaging/arch/PKGBUILD.prebuilt

@@ -1,4 +1,4 @@
-# CI package recipe for a prebuilt Souveraine aarch64 binary.
+# CI package recipe for prebuilt Souveraine binaries.
 #
 # The runner cross-compiles first, then makepkg assembles this package.  This
 # deliberately avoids compiling on the phone and keeps its agent data outside
@@ -15,18 +15,17 @@ options=('!strip')
 source=('souveraine-binary' 'souveraine.service'
         'souveraine-secrets-binary' 'souveraine-secrets.service'
         'souveraine-machined-binary' 'souveraine-machined.service'
+        'souveraine-sessiond-binary' 'souveraine-sessiond.service'
         'souveraine-verify-trail' 'souveraine-button'
         'LICENSE')
-sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
-# sessiond ships on aarch64 only (the phone is its target; the laptop hit
-# lock-screen errors with it). CI drops the two files into the build dir for
-# that arch and omits them otherwise, so package() picks them up conditionally
-# rather than declaring them as sources for every arch.
+sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP'
+            'SKIP' 'SKIP' 'SKIP')
+# sessiond is built and packaged for both supported architectures. Installing
+# its user unit does not enable or start it; activation remains target-owned.
 if [ "$CARCH" = aarch64 ]; then
-    source+=('souveraine-sessiond-binary' 'souveraine-sessiond.service'
-             'souveraine-sensord-binary' 'souveraine-sensord.service'
+    source+=('souveraine-sensord-binary' 'souveraine-sensord.service'
              'souveraine-usb-kvm-binary')
-    sha256sums+=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
+    sha256sums+=('SKIP' 'SKIP' 'SKIP')
     depends+=('wayland' 'libx11' 'libxcursor' 'libxi' 'libxkbcommon' 'libxrandr')
     # The wry host links the system webview, so it only cross-builds once
     # webkit2gtk is in the aarch64 sysroot. Declared only when CI actually
@@ -43,16 +42,12 @@ package() {
     install -Dm755 "$srcdir/souveraine-binary" "$pkgdir/usr/bin/souveraine"
     sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' "$srcdir/souveraine.service" \
         | install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
-    # Session authority daemon, aarch64 only. Was hand-copied to
-    # /usr/local/bin and owned by no package, so it never received updates.
-    # The unit points at /usr/bin: the stale /usr/local/bin copy must be
-    # removed after installing or the old binary keeps running.
-    if [ -f "$srcdir/souveraine-sessiond-binary" ]; then
-        install -Dm755 "$srcdir/souveraine-sessiond-binary" \
-            "$pkgdir/usr/bin/souveraine-sessiond"
-        install -Dm644 "$srcdir/souveraine-sessiond.service" \
-            "$pkgdir/usr/lib/systemd/user/souveraine-sessiond.service"
-    fi
+    # Session authority daemon, package-owned on both architectures. The unit
+    # points at /usr/bin and package installation does not enable or start it.
+    install -Dm755 "$srcdir/souveraine-sessiond-binary" \
+        "$pkgdir/usr/bin/souveraine-sessiond"
+    install -Dm644 "$srcdir/souveraine-sessiond.service" \
+        "$pkgdir/usr/lib/systemd/user/souveraine-sessiond.service"
     # Sensor reporter, aarch64 only — the laptop has no iio-sensor-proxy
     # sources worth reporting and no device state machine listening.
     if [ -f "$srcdir/souveraine-web-binary" ]; then