# CI package recipe for prebuilt Souveraine binaries.
#
# The runner cross-compiles first, then makepkg assembles this package.  This
# deliberately avoids compiling on the phone and keeps its agent data outside
# pacman's ownership.
pkgname=souveraine
pkgver="${SOUVERAINE_PKGVER:?CI must set SOUVERAINE_PKGVER}"
pkgrel=1
pkgdesc="Sovereign agent substrate — server, TUI, surfaces"
arch=("${SOUVERAINE_PKGARCH:?CI must set SOUVERAINE_PKGARCH}")
url="https://gitea.wiuf.net/Fimeg/souveraine"
license=('MIT')
depends=('gcc-libs' 'alsa-lib' 'pam')
options=('!strip')
backup=('etc/pam.d/souveraine-stepup' 'etc/pam.d/souveraine-sessiond')
source=('souveraine-binary' 'souveraine.service'
        'souveraine-secrets-binary' 'souveraine-secrets.service'
        'souveraine-machined-binary' 'souveraine-machined.service'
        'souveraine-admit-binary'
        'souveraine.sysusers'
        'souveraine-sessiond-binary' 'souveraine-sessiond.service'
        'souveraine-sensord-binary' 'souveraine-sensord.service'
        'souveraine-sessiond.pam'
        'souveraine-verify-trail' 'souveraine-button'
        'souveraine-stepup.pam' 'org.souveraine.stepup.policy'
        'LICENSE')
sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP'
            'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
# sessiond is built and packaged for both supported architectures. Installing
# its user unit does not enable or start it; activation remains target-owned.
if [ "$CARCH" = aarch64 ]; then
    source+=('souveraine-usb-kvm-binary')
    sha256sums+=('SKIP')
    depends+=('wayland' 'libx11' 'libxcursor' 'libxi' 'libxkbcommon' 'libxrandr')
    # The wry host links the system webview, so it only cross-builds once
    # webkit2gtk is in the aarch64 sysroot. Declared only when CI actually
    # produced one: makepkg validates every entry in `source`, so naming a file
    # that is not there fails the entire package — and the avatar must never be
    # what stops sessiond reaching the phone.
    if [ -f "$startdir/souveraine-web-binary" ]; then
        source+=('souveraine-web-binary')
        sha256sums+=('SKIP')
    fi
fi

package() {
    install -Dm755 "$srcdir/souveraine-binary" "$pkgdir/usr/bin/souveraine"
    sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' "$srcdir/souveraine.service" \
        | install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
    # Session authority daemon, package-owned on both architectures. The unit
    # points at /usr/bin and package installation does not enable or start it.
    install -Dm755 "$srcdir/souveraine-sessiond-binary" \
        "$pkgdir/usr/bin/souveraine-sessiond"
    install -Dm644 "$srcdir/souveraine-sessiond.service" \
        "$pkgdir/usr/lib/systemd/user/souveraine-sessiond.service"
    # The fallback surface's PAM stack. Root-owned, so package or nothing —
    # the phone's copy arrived by hand on 2026-07-16, owned by no package, and
    # had not been touched since (TASK-76).
    install -Dm644 "$srcdir/souveraine-sessiond.pam" \
        "$pkgdir/etc/pam.d/souveraine-sessiond"
    # The wry host, aarch64 only (webkit2gtk in the sysroot is the gate).
    if [ -f "$srcdir/souveraine-web-binary" ]; then
        install -Dm755 "$srcdir/souveraine-web-binary" \
            "$pkgdir/usr/bin/souveraine-web"
    fi

    # Sensor reporter, both arches. It stopped being phone-only when charge
    # became a source: sessiond never probes the supplies itself, so the
    # reporter is the only thing that feeds charge evidence — and the laptop
    # has a battery.
    if [ -f "$srcdir/souveraine-sensord-binary" ]; then
        install -Dm755 "$srcdir/souveraine-sensord-binary" \
            "$pkgdir/usr/bin/souveraine-sensord"
        install -Dm644 "$srcdir/souveraine-sensord.service" \
            "$pkgdir/usr/lib/systemd/user/souveraine-sensord.service"
    fi
    if [ -f "$srcdir/souveraine-usb-kvm-binary" ]; then
        install -Dm755 "$srcdir/souveraine-usb-kvm-binary" \
            "$pkgdir/usr/bin/souveraine-usb-kvm"
    fi
    # Hardware button reporter. Every arch: it decides nothing and depends on
    # nothing, and a laptop with a power button is the same shape. Replaces
    # blueline-power-button, which was owned by no package and carried its own
    # copy of the lock-then-blank ordering.
    install -Dm755 "$srcdir/souveraine-button" "$pkgdir/usr/bin/souveraine-button"
    # Secrets rail (user service, owns org.freedesktop.secrets) and machined
    # (system service, machine identity). Both were hand-copied to the phone
    # and owned by no package — same gap as sessiond.
    install -Dm755 "$srcdir/souveraine-secrets-binary" "$pkgdir/usr/bin/souveraine-secrets"
    install -Dm644 "$srcdir/souveraine-secrets.service" \
        "$pkgdir/usr/lib/systemd/user/souveraine-secrets.service"
    # NOT shipping /usr/share/dbus-1/services/org.freedesktop.secrets.service:
    # gnome-keyring owns that path, and two packages claiming the secrets
    # provider is the collision the session-authority doctrine warns about.
    # souveraine-secrets.service already owns the bus name at runtime, so the
    # rail works without stealing the D-Bus activation file.

    # The admission executor. Root-only in use, so it ships 0755 and refuses
    # itself rather than carrying setuid.
    install -Dm755 "$srcdir/souveraine-admit-binary" "$pkgdir/usr/bin/souveraine-admit"
    install -Dm755 "$srcdir/souveraine-machined-binary" "$pkgdir/usr/bin/souveraine-machined"
    install -Dm644 "$srcdir/souveraine-machined.service" \
        "$pkgdir/usr/lib/systemd/system/souveraine-machined.service"
    # This is the machine-tier daemon account, not Souvie's agent principal.
    # The development recipe already shipped it; keep the CI package—the
    # artifact devices install—on the same contract.
    install -Dm644 "$srcdir/souveraine.sysusers" \
        "$pkgdir/usr/lib/sysusers.d/souveraine.conf"

    # Verifies the forensic trail's hash chain. Ships with the daemon that
    # writes it, not in the rootfs overlay: the overlay only reaches a device
    # at provision time, and the phone is not reflashed. Evidence nobody can
    # check is not evidence (DEVICE-STATE-MACHINE.md §11).
    install -Dm755 "$srcdir/souveraine-verify-trail" \
        "$pkgdir/usr/bin/souveraine-verify-trail"

    # Step-up authentication. Root-owned system config, so it can only arrive
    # by package — rootfs-overlay/ reaches a device on flash and the phone does
    # not flash (TASK-28). Both arches: the laptop authenticates by password
    # until it has a second factor.
    install -Dm644 "$srcdir/souveraine-stepup.pam" \
        "$pkgdir/etc/pam.d/souveraine-stepup"
    install -Dm644 "$srcdir/org.souveraine.stepup.policy" \
        "$pkgdir/usr/share/polkit-1/actions/org.souveraine.stepup.policy"

    install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
}