af60d9e401
The development recipe installed the sysusers declaration; the CI package that devices consume quietly dropped it. Ship the machine-tier souveraine account in the prebuilt package and assert the file is present before publishing.\n\nThis account belongs to machined. Souvie gets her own principal through agent admission.
123 lines
6.6 KiB
Text
123 lines
6.6 KiB
Text
# CI package recipe for prebuilt Souveraine binaries.
|
|
#
|
|
# The runner cross-compiles first, then makepkg assembles this package. This
|
|
# deliberately avoids compiling on the phone and keeps its agent data outside
|
|
# pacman's ownership.
|
|
pkgname=souveraine
|
|
pkgver="${SOUVERAINE_PKGVER:?CI must set SOUVERAINE_PKGVER}"
|
|
pkgrel=1
|
|
pkgdesc="Sovereign agent substrate — server, TUI, surfaces"
|
|
arch=("${SOUVERAINE_PKGARCH:?CI must set SOUVERAINE_PKGARCH}")
|
|
url="https://gitea.wiuf.net/Fimeg/souveraine"
|
|
license=('MIT')
|
|
depends=('gcc-libs' 'alsa-lib' 'pam')
|
|
options=('!strip')
|
|
backup=('etc/pam.d/souveraine-stepup' 'etc/pam.d/souveraine-sessiond')
|
|
source=('souveraine-binary' 'souveraine.service'
|
|
'souveraine-secrets-binary' 'souveraine-secrets.service'
|
|
'souveraine-machined-binary' 'souveraine-machined.service'
|
|
'souveraine.sysusers'
|
|
'souveraine-sessiond-binary' 'souveraine-sessiond.service'
|
|
'souveraine-sensord-binary' 'souveraine-sensord.service'
|
|
'souveraine-sessiond.pam'
|
|
'souveraine-verify-trail' 'souveraine-button'
|
|
'souveraine-stepup.pam' 'org.souveraine.stepup.policy'
|
|
'LICENSE')
|
|
sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP'
|
|
'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
|
|
# sessiond is built and packaged for both supported architectures. Installing
|
|
# its user unit does not enable or start it; activation remains target-owned.
|
|
if [ "$CARCH" = aarch64 ]; then
|
|
source+=('souveraine-usb-kvm-binary')
|
|
sha256sums+=('SKIP')
|
|
depends+=('wayland' 'libx11' 'libxcursor' 'libxi' 'libxkbcommon' 'libxrandr')
|
|
# The wry host links the system webview, so it only cross-builds once
|
|
# webkit2gtk is in the aarch64 sysroot. Declared only when CI actually
|
|
# produced one: makepkg validates every entry in `source`, so naming a file
|
|
# that is not there fails the entire package — and the avatar must never be
|
|
# what stops sessiond reaching the phone.
|
|
if [ -f "$startdir/souveraine-web-binary" ]; then
|
|
source+=('souveraine-web-binary')
|
|
sha256sums+=('SKIP')
|
|
fi
|
|
fi
|
|
|
|
package() {
|
|
install -Dm755 "$srcdir/souveraine-binary" "$pkgdir/usr/bin/souveraine"
|
|
sed 's|%h/.local/bin/souveraine|/usr/bin/souveraine|' "$srcdir/souveraine.service" \
|
|
| install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/souveraine.service"
|
|
# Session authority daemon, package-owned on both architectures. The unit
|
|
# points at /usr/bin and package installation does not enable or start it.
|
|
install -Dm755 "$srcdir/souveraine-sessiond-binary" \
|
|
"$pkgdir/usr/bin/souveraine-sessiond"
|
|
install -Dm644 "$srcdir/souveraine-sessiond.service" \
|
|
"$pkgdir/usr/lib/systemd/user/souveraine-sessiond.service"
|
|
# The fallback surface's PAM stack. Root-owned, so package or nothing —
|
|
# the phone's copy arrived by hand on 2026-07-16, owned by no package, and
|
|
# had not been touched since (TASK-76).
|
|
install -Dm644 "$srcdir/souveraine-sessiond.pam" \
|
|
"$pkgdir/etc/pam.d/souveraine-sessiond"
|
|
# The wry host, aarch64 only (webkit2gtk in the sysroot is the gate).
|
|
if [ -f "$srcdir/souveraine-web-binary" ]; then
|
|
install -Dm755 "$srcdir/souveraine-web-binary" \
|
|
"$pkgdir/usr/bin/souveraine-web"
|
|
fi
|
|
|
|
# Sensor reporter, both arches. It stopped being phone-only when charge
|
|
# became a source: sessiond never probes the supplies itself, so the
|
|
# reporter is the only thing that feeds charge evidence — and the laptop
|
|
# has a battery.
|
|
if [ -f "$srcdir/souveraine-sensord-binary" ]; then
|
|
install -Dm755 "$srcdir/souveraine-sensord-binary" \
|
|
"$pkgdir/usr/bin/souveraine-sensord"
|
|
install -Dm644 "$srcdir/souveraine-sensord.service" \
|
|
"$pkgdir/usr/lib/systemd/user/souveraine-sensord.service"
|
|
fi
|
|
if [ -f "$srcdir/souveraine-usb-kvm-binary" ]; then
|
|
install -Dm755 "$srcdir/souveraine-usb-kvm-binary" \
|
|
"$pkgdir/usr/bin/souveraine-usb-kvm"
|
|
fi
|
|
# Hardware button reporter. Every arch: it decides nothing and depends on
|
|
# nothing, and a laptop with a power button is the same shape. Replaces
|
|
# blueline-power-button, which was owned by no package and carried its own
|
|
# copy of the lock-then-blank ordering.
|
|
install -Dm755 "$srcdir/souveraine-button" "$pkgdir/usr/bin/souveraine-button"
|
|
# Secrets rail (user service, owns org.freedesktop.secrets) and machined
|
|
# (system service, machine identity). Both were hand-copied to the phone
|
|
# and owned by no package — same gap as sessiond.
|
|
install -Dm755 "$srcdir/souveraine-secrets-binary" "$pkgdir/usr/bin/souveraine-secrets"
|
|
install -Dm644 "$srcdir/souveraine-secrets.service" \
|
|
"$pkgdir/usr/lib/systemd/user/souveraine-secrets.service"
|
|
# NOT shipping /usr/share/dbus-1/services/org.freedesktop.secrets.service:
|
|
# gnome-keyring owns that path, and two packages claiming the secrets
|
|
# provider is the collision the session-authority doctrine warns about.
|
|
# souveraine-secrets.service already owns the bus name at runtime, so the
|
|
# rail works without stealing the D-Bus activation file.
|
|
|
|
install -Dm755 "$srcdir/souveraine-machined-binary" "$pkgdir/usr/bin/souveraine-machined"
|
|
install -Dm644 "$srcdir/souveraine-machined.service" \
|
|
"$pkgdir/usr/lib/systemd/system/souveraine-machined.service"
|
|
# This is the machine-tier daemon account, not Souvie's agent principal.
|
|
# The development recipe already shipped it; keep the CI package—the
|
|
# artifact devices install—on the same contract.
|
|
install -Dm644 "$srcdir/souveraine.sysusers" \
|
|
"$pkgdir/usr/lib/sysusers.d/souveraine.conf"
|
|
|
|
# Verifies the forensic trail's hash chain. Ships with the daemon that
|
|
# writes it, not in the rootfs overlay: the overlay only reaches a device
|
|
# at provision time, and the phone is not reflashed. Evidence nobody can
|
|
# check is not evidence (DEVICE-STATE-MACHINE.md §11).
|
|
install -Dm755 "$srcdir/souveraine-verify-trail" \
|
|
"$pkgdir/usr/bin/souveraine-verify-trail"
|
|
|
|
# Step-up authentication. Root-owned system config, so it can only arrive
|
|
# by package — rootfs-overlay/ reaches a device on flash and the phone does
|
|
# not flash (TASK-28). Both arches: the laptop authenticates by password
|
|
# until it has a second factor.
|
|
install -Dm644 "$srcdir/souveraine-stepup.pam" \
|
|
"$pkgdir/etc/pam.d/souveraine-stepup"
|
|
install -Dm644 "$srcdir/org.souveraine.stepup.policy" \
|
|
"$pkgdir/usr/share/polkit-1/actions/org.souveraine.stepup.policy"
|
|
|
|
install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
|
|
}
|