c802f7db48
CI already built the x86_64 daemon and then threw it away — the binary and its user unit were copied into the package only under aarch64, so the laptop could never receive the thing every lock, blank and button report assumes is running. Both now ship, and the package still neither enables nor starts the unit. Phone-only reporters and surfaces stay aarch64.
96 lines
5.1 KiB
Text
96 lines
5.1 KiB
Text
# CI package recipe for prebuilt Souveraine binaries.
|
|
#
|
|
# The runner cross-compiles first, then makepkg assembles this package. This
|
|
# deliberately avoids compiling on the phone and keeps its agent data outside
|
|
# pacman's ownership.
|
|
pkgname=souveraine
|
|
pkgver="${SOUVERAINE_PKGVER:?CI must set SOUVERAINE_PKGVER}"
|
|
pkgrel=1
|
|
pkgdesc="Sovereign agent substrate — server, TUI, surfaces"
|
|
arch=("${SOUVERAINE_PKGARCH:?CI must set SOUVERAINE_PKGARCH}")
|
|
url="https://gitea.wiuf.net/Fimeg/souveraine"
|
|
license=('MIT')
|
|
depends=('gcc-libs' 'alsa-lib')
|
|
options=('!strip')
|
|
source=('souveraine-binary' 'souveraine.service'
|
|
'souveraine-secrets-binary' 'souveraine-secrets.service'
|
|
'souveraine-machined-binary' 'souveraine-machined.service'
|
|
'souveraine-sessiond-binary' 'souveraine-sessiond.service'
|
|
'souveraine-verify-trail' 'souveraine-button'
|
|
'LICENSE')
|
|
sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP'
|
|
'SKIP' 'SKIP' 'SKIP')
|
|
# sessiond is built and packaged for both supported architectures. Installing
|
|
# its user unit does not enable or start it; activation remains target-owned.
|
|
if [ "$CARCH" = aarch64 ]; then
|
|
source+=('souveraine-sensord-binary' 'souveraine-sensord.service'
|
|
'souveraine-usb-kvm-binary')
|
|
sha256sums+=('SKIP' 'SKIP' 'SKIP')
|
|
depends+=('wayland' 'libx11' 'libxcursor' 'libxi' 'libxkbcommon' 'libxrandr')
|
|
# The wry host links the system webview, so it only cross-builds once
|
|
# webkit2gtk is in the aarch64 sysroot. Declared only when CI actually
|
|
# produced one: makepkg validates every entry in `source`, so naming a file
|
|
# that is not there fails the entire package — and the avatar must never be
|
|
# what stops sessiond reaching the phone.
|
|
if [ -f "$startdir/souveraine-web-binary" ]; then
|
|
source+=('souveraine-web-binary')
|
|
sha256sums+=('SKIP')
|
|
fi
|
|
fi
|
|
|
|
package() {
|
|
install -Dm755 "$srcdir/souveraine-binary" "$pkgdir/usr/bin/souveraine"
|
|
sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' "$srcdir/souveraine.service" \
|
|
| install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
|
|
# Session authority daemon, package-owned on both architectures. The unit
|
|
# points at /usr/bin and package installation does not enable or start it.
|
|
install -Dm755 "$srcdir/souveraine-sessiond-binary" \
|
|
"$pkgdir/usr/bin/souveraine-sessiond"
|
|
install -Dm644 "$srcdir/souveraine-sessiond.service" \
|
|
"$pkgdir/usr/lib/systemd/user/souveraine-sessiond.service"
|
|
# Sensor reporter, aarch64 only — the laptop has no iio-sensor-proxy
|
|
# sources worth reporting and no device state machine listening.
|
|
if [ -f "$srcdir/souveraine-web-binary" ]; then
|
|
install -Dm755 "$srcdir/souveraine-web-binary" \
|
|
"$pkgdir/usr/bin/souveraine-web"
|
|
fi
|
|
|
|
if [ -f "$srcdir/souveraine-sensord-binary" ]; then
|
|
install -Dm755 "$srcdir/souveraine-sensord-binary" \
|
|
"$pkgdir/usr/bin/souveraine-sensord"
|
|
install -Dm644 "$srcdir/souveraine-sensord.service" \
|
|
"$pkgdir/usr/lib/systemd/user/souveraine-sensord.service"
|
|
fi
|
|
if [ -f "$srcdir/souveraine-usb-kvm-binary" ]; then
|
|
install -Dm755 "$srcdir/souveraine-usb-kvm-binary" \
|
|
"$pkgdir/usr/bin/souveraine-usb-kvm"
|
|
fi
|
|
# Hardware button reporter. Every arch: it decides nothing and depends on
|
|
# nothing, and a laptop with a power button is the same shape. Replaces
|
|
# blueline-power-button, which was owned by no package and carried its own
|
|
# copy of the lock-then-blank ordering.
|
|
install -Dm755 "$srcdir/souveraine-button" "$pkgdir/usr/bin/souveraine-button"
|
|
# Secrets rail (user service, owns org.freedesktop.secrets) and machined
|
|
# (system service, machine identity). Both were hand-copied to the phone
|
|
# and owned by no package — same gap as sessiond.
|
|
install -Dm755 "$srcdir/souveraine-secrets-binary" "$pkgdir/usr/bin/souveraine-secrets"
|
|
install -Dm644 "$srcdir/souveraine-secrets.service" \
|
|
"$pkgdir/usr/lib/systemd/user/souveraine-secrets.service"
|
|
# NOT shipping /usr/share/dbus-1/services/org.freedesktop.secrets.service:
|
|
# gnome-keyring owns that path, and two packages claiming the secrets
|
|
# provider is the collision the session-authority doctrine warns about.
|
|
# souveraine-secrets.service already owns the bus name at runtime, so the
|
|
# rail works without stealing the D-Bus activation file.
|
|
|
|
install -Dm755 "$srcdir/souveraine-machined-binary" "$pkgdir/usr/bin/souveraine-machined"
|
|
install -Dm644 "$srcdir/souveraine-machined.service" \
|
|
"$pkgdir/usr/lib/systemd/system/souveraine-machined.service"
|
|
|
|
# Verifies the forensic trail's hash chain. Ships with the daemon that
|
|
# writes it, not in the rootfs overlay: the overlay only reaches a device
|
|
# at provision time, and the phone is not reflashed. Evidence nobody can
|
|
# check is not evidence (DEVICE-STATE-MACHINE.md §11).
|
|
install -Dm755 "$srcdir/souveraine-verify-trail" \
|
|
"$pkgdir/usr/bin/souveraine-verify-trail"
|
|
install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
|
|
}
|