Repository navigation
feat: arch linux AUR binary package - #7
Merged
Merged
Conversation
The AppImage mounts a compressed image on every launch. The same audited AppDir, tarred and extracted once into /opt/spool, starts from ordinary files, so packaging takes that route rather than installing the AppImage. Nothing is built twice: package-linux-bundle.sh archives the AppDir that package-appimage.sh has already deployed, stripped and audited, and package-arch.sh feeds that tarball to makepkg in an Arch container using the same PKGBUILD packaging/aur ships. AppRun learns SPOOL_PORTABLE_BUNDLE so an installed copy keeps native Wayland instead of taking the XWayland path that exists for the AppImage runtime on NixOS. The AUR is not accepting registrations, so the recipe and its .SRCINFO wait in packaging/aur; check-release-version.sh holds their pkgver to VERSION so a bump cannot leave the published recipe behind. Claude-Session: https://claude.ai/code/session_01UKBXE39huqqsjEe94L459a
The SBOM sidecars explain themselves by their names, and a release page that opens with a paragraph about what is not signed buries the downloads it exists to hand out. The macOS line stays while the DMG is unsigned, because that one changes what somebody has to do to open the app. Claude-Session: https://claude.ai/code/session_01UKBXE39huqqsjEe94L459a
The recipe cannot carry a checksum for a file that does not exist yet, so the release job fills it in afterwards: it reads the tarball's line out of the published SHA256SUMS.txt, writes it into PKGBUILD, regenerates .SRCINFO with makepkg and commits that to master. A tag that master has already moved past leaves the recipe alone rather than recording a checksum for a release it no longer names. Both makepkg users now share tools/lib/arch-container.sh, so the Arch container, its unprivileged build user and the ownership fix are written once. This is also the shape an AUR push takes later: packaging/aur is release-accurate on every tag, so publishing is a clone, a copy of these two files, and a push. Claude-Session: https://claude.ai/code/session_01UKBXE39huqqsjEe94L459a
There was a problem hiding this comment.
🟡 Changes recommended
Multiple moderate issues remain in packaging behavior, release analysis, and workflow reliability.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds Arch Linux binary packaging from the existing Linux bundle, including portable tarballs, AUR metadata, and release automation.
Changes:
- Builds deterministic Linux tarballs and Arch packages.
- Adds AUR checksum generation and release-version validation.
- Updates documentation, display handling, and CI/release workflows.
Review findings:
.github/workflows/build-artifacts.yml:342— Arch packages are not included in SBOM or vulnerability analysis before publishing. Severity: moderate; votes: 2..github/workflows/release.yml:151— Security guidance for checksums, attestations, unsigned Windows binaries, and SBOMs was removed. Severity: nit; votes: 2..github/workflows/release.yml:279— Concurrent changes tomastercan cause the AUR checksum push to fail. Severity: moderate; votes: 2.docs/install/arch.md:14— The installation command is fixed to release0.7.13. Severity: nit; votes: 1.tools/lib/arch-container.sh:35—ARTIFACT_DIRis not forwarded into the container. Severity: moderate; votes: 1.tools/package-appimage.sh:414— The portable tarball does not mark itself for native Wayland behavior. Severity: moderate; votes: 1.tools/package-arch.sh:12—ARTIFACT_DIRis not exported before container re-execution. Severity: moderate; votes: 1.tools/package-linux-bundle.sh:29— The portable tarball does not set its portable-bundle marker. Severity: moderate; votes: 2.
File summaries
| File | Description |
|---|---|
tools/update-aur-checksums.sh |
Updates AUR checksums and .SRCINFO. |
tools/package-linux-bundle.sh |
Creates the portable tarball. |
tools/package-arch.sh |
Builds and validates Arch packages. |
tools/package-appimage.sh |
Adjusts Wayland/XWayland selection. |
tools/lib/arch-container.sh |
Provides Arch container helpers. |
tools/check-release-version.sh |
Validates Arch packaging versions. |
packaging/aur/PKGBUILD |
Defines the binary AUR recipe. |
packaging/aur/.SRCINFO |
Stores generated AUR metadata. |
flake.nix |
Adds zstd to native tooling. |
docs/install/arch.md |
Documents Arch installation. |
.github/workflows/release.yml |
Publishes assets and updates AUR checksums. |
.github/workflows/build-artifacts.yml |
Builds and uploads Linux packages. |
Review details
Suppressed comments (4)
docs/install/arch.md:14
- This command is fixed to the current
0.7.13release, so the guide will direct users of every later release to download an old, likely nonexistent asset. Use a version placeholder (or otherwise update this example as part of each release).
sudo pacman -U spool-bin-0.7.13-1-x86_64.pkg.tar.zst
tools/lib/arch-container.sh:37
package-arch.shexposesARTIFACT_DIR, but this container re-exec only forwardsSOURCE_DATE_EPOCH. Any non-default output directory is therefore lost inside the container, so the child falls back to/spool/distand can fail to find the input tarball or write to the requested location. Forward this setting and define whether paths outside the mounted checkout should be mounted or rejected.
-e "SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-0}" \
-v "$root:/spool" -w /spool "$image" \
bash "$script" "$@"
tools/package-appimage.sh:415
- The published portable tarball contains
AppRunverbatim and does not add theSPOOL_PORTABLE_BUNDLE=1launcher that the Arch package adds. Extracting that tarball and runningAppRunwithDISPLAYset therefore takes thexcbbranch becauseHEREis not/tmp/.mount_*, contradicting the stated native-Wayland behavior for portable installs. Mark the tarball copy as portable or provide a launcher that exports the flag.
if [[ "${SPOOL_PORTABLE_BUNDLE:-0}" != 1 \
&& "$HERE" != /tmp/.mount_* && -n "${DISPLAY:-}" ]]; then
tools/package-arch.sh:12
ARTIFACT_DIRis assigned but not exported beforearch_container_reexec. If a caller setsARTIFACT_DIRto a non-default output directory, the container does not receive it, so the re-executed script falls back to/spool/distand reports the bundle missing or writes the package to the wrong directory. Export this value before entering the container.
ARTIFACT_DIR="${ARTIFACT_DIR:-$APP_ROOT/dist}"
- Files reviewed: 12/12 changed files
- Comments generated: 4
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+342
to
+343
| - name: Package Arch binary package | ||
| run: bash tools/package-arch.sh |
| git config user.name 'github-actions[bot]' | ||
| git config user.email '41898282+github-actions[bot]@users.noreply.github.com' | ||
| git commit -m "chore(aur): record the $TAG tarball checksum" -- packaging/aur | ||
| git push origin HEAD:master |
| mkdir -p "$ARTIFACT_DIR" | ||
| stage="$(mktemp -d)" | ||
| trap 'chmod -R u+w "$stage" 2>/dev/null || true; rm -rf "$stage"' EXIT | ||
| cp -a "$APPDIR" "$stage/$BUNDLE" |
Comment on lines
151
to
153
| echo "Checksums: [\`SHA256SUMS.txt\`]($base/SHA256SUMS.txt)." | ||
| echo "The \`.spdx.json\`, \`.cdx.json\` and \`.grype.json\` assets are per-package SBOMs and vulnerability scans — nothing you need in order to install." | ||
| echo | ||
| fi |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.