From c8c72ecbf22259991281606741630cd8371ba308 Mon Sep 17 00:00:00 2001
From: Fimeg <casey.tunturi@gmail.com>
Date: Sun, 12 Jul 2026 22:19:44 -0400
Subject: [PATCH] ci: split signed pacman databases by architecture

---
 .gitea/workflows/ci.yml             | 34 +++++++++++++++++------------
 packaging/arch/souveraine-edge.conf |  8 ++++---
 2 files changed, 25 insertions(+), 17 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a86522b..840d84a 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -131,7 +131,8 @@ jobs:
 
           for ARCH in aarch64 x86_64; do
             PKG_WORK="$WORK/$ARCH"
-            mkdir -p "$PKG_WORK"
+            ARCH_REPO="$REPO/$ARCH"
+            mkdir -p "$PKG_WORK" "$ARCH_REPO"
             cp "souveraine-$ARCH" "$PKG_WORK/souveraine-binary"
             cp packaging/souveraine.service LICENSE "$PKG_WORK/"
             cp packaging/arch/PKGBUILD.prebuilt "$PKG_WORK/PKGBUILD"
@@ -144,20 +145,25 @@ jobs:
             PKG=$(find "$PKG_WORK" -maxdepth 1 -name 'souveraine-*.pkg.tar.zst' -print -quit)
             test -n "$PKG"
             bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine'
-            cp "$PKG" "$REPO/"
-            gpg --batch --yes --local-user "$ARCHIVE_KEY" --detach-sign "$REPO/$(basename "$PKG")"
-          done
+            cp "$PKG" "$ARCH_REPO/"
+            gpg --batch --yes --local-user "$ARCHIVE_KEY" \
+              --detach-sign "$ARCH_REPO/$(basename "$PKG")"
 
-          repo-add --include-sigs --sign --key "$ARCHIVE_KEY" \
-            "$REPO/souveraine.db.tar.zst" "$REPO"/*.pkg.tar.zst
-          # Pacman requests <repo>.db; release assets cannot preserve the
-          # symlink repo-add normally creates, so replace it with real files.
-          rm -f "$REPO/souveraine.db"
-          cp "$REPO/souveraine.db.tar.zst" "$REPO/souveraine.db"
-          cp "$REPO/souveraine.db.tar.zst.sig" "$REPO/souveraine.db.sig"
+            # Pacman databases are architecture-specific: one database cannot
+            # retain two same-named, same-version packages for different
+            # architectures. Keep each database and its assets distinct.
+            DB="souveraine-${ARCH}"
+            repo-add --include-sigs --sign --key "$ARCHIVE_KEY" \
+              "$ARCH_REPO/$DB.db.tar.zst" "$ARCH_REPO"/*.pkg.tar.zst
+            # repo-add makes .db and .db.sig symlinks. Release assets cannot
+            # preserve those, so replace both links with real files.
+            rm -f "$ARCH_REPO/$DB.db" "$ARCH_REPO/$DB.db.sig"
+            cp "$ARCH_REPO/$DB.db.tar.zst" "$ARCH_REPO/$DB.db"
+            cp "$ARCH_REPO/$DB.db.tar.zst.sig" "$ARCH_REPO/$DB.db.sig"
+            sha256sum "$ARCH_REPO"/*.pkg.tar.zst "$ARCH_REPO/$DB.db" \
+              > "$REPO/$DB-repo.sha256"
+          done
           cp packaging/arch/souveraine-archive-key.asc "$REPO/"
-          sha256sum "$REPO"/*.pkg.tar.zst "$REPO/souveraine.db" \
-            > "$REPO/souveraine-repo.sha256"
 
       - name: Publish rolling edge prerelease
         run: |
@@ -182,7 +188,7 @@ jobs:
             | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
 
           for f in souveraine-aarch64 souveraine-x86_64 souveraine-binaries.sha256 \
-            "$GITHUB_WORKSPACE"/pacman-repo/*; do
+            $(find "$GITHUB_WORKSPACE/pacman-repo" -type f -print); do
             curl -sf -X POST -H "$AUTH" \
               "$API/repos/${GITHUB_REPOSITORY}/releases/${REL_ID}/assets?name=$(basename "$f")" \
               -F "attachment=@${f}" -o /dev/null
diff --git a/packaging/arch/souveraine-edge.conf b/packaging/arch/souveraine-edge.conf
index db9e7c6..750582a 100644
--- a/packaging/arch/souveraine-edge.conf
+++ b/packaging/arch/souveraine-edge.conf
@@ -1,13 +1,15 @@
 # Install a local copy of this file as /etc/pacman.d/souveraine-edge.conf, then
 # add `Include = /etc/pacman.d/souveraine-edge.conf` to /etc/pacman.conf.
 #
-# This is a private, LAN-only archive. Replace __LOCAL_GITEA_TOKEN__ in the
-# *installed* copy with the local-Gitea token. Do not commit that replacement.
+# This is a private, LAN-only archive. Replace __LOCAL_GITEA_TOKEN__ and
+# __ARCH__ in the *installed* copy with the local-Gitea token and the machine's
+# architecture (aarch64 on the phone, x86_64 on the laptop). Do not commit
+# those replacements.
 # Keep the installed file root-readable only (mode 0600).
 #
 # Bootstrap the archive key first:
 #   pacman-key --add souveraine-archive-key.asc
 #   pacman-key --lsign-key 3CD9E99E222C2A174986FC9AFF4949AA20C8E911
-[souveraine]
+[souveraine-__ARCH__]
 SigLevel = Required DatabaseRequired
 Server = http://__LOCAL_GITEA_TOKEN__@10.10.20.120:4455/Fimeg/souveraine/releases/download/edge