Publish ahfail-bin, hosted on the tarballz index

A second AUR package with the same release prebuilt. The workflow builds the tag into a staged meson install tree (--prefix=/usr, no update check), names the tarball after its sha256 so a published name never changes bytes, uploads it to asger.weirsoe.dk/tarballz with a key that may only write ahfail-* tarballs, checks that the public URL serves the same bytes, and only then pushes ahfail-bin to the AUR. A manual run can now publish source, bin or both. Claude-Session: https://claude.ai/code/session_012LCTmU2ewo8tnM1dByYAoG
2026-09-30 21:41:11 +02:00
parent a1a9a741cc
commit 1934b86c13
3 changed files with 220 additions and 0 deletions
@@ -0,0 +1,58 @@
+# Maintainer: Asger Geel Weirsoe <asger at weircon dot dk>
+#
+# DISCLAIMER
+#
+# ahfail is a joke with a real screen locker underneath. Two things to know
+# before installing it:
+#
+# 1. Security. It sits in the authentication path of your session. It is
+#    provided as is, without any warranty (see the AGPL-3.0 license). On
+#    Wayland a crash leaves the session locked; on X11, as with i3lock, a
+#    killed locker leaves it open. /etc/pam.d/ahfail includes `login`, so
+#    the system's pam_faillock policy applies to wrong guesses.
+#
+# 2. Media. The sprite frames and the audio clip are a parody of the
+#    "ah ah ah, you didn't say the magic word" scene from Jurassic Park
+#    (1993). The film and its characters belong to their respective rights
+#    holders; they are used here non-commercially for parody, and the
+#    AGPL-3.0 license covers the code, not those assets. Rights holders who
+#    object can reach the maintainer at the address above and the assets
+#    will be replaced.
+#
+# PROVENANCE OF THE BINARY
+#
+# Built by the gtk-ahfail release workflow from the tagged source, in an
+# archlinux:base-devel container, with --prefix=/usr and without the Gitea
+# update check. The same recipe builds the source package `ahfail`.
+#
+#   build recipe:  https://gitea.weircon.dk/agw/gtk-ahfail
+#   download:      https://asger.weirsoe.dk/tarballz/@TARBALL@
+
+pkgname=ahfail-bin
+pkgver=0.0.0
+pkgrel=1
+pkgdesc="Screen locker that says 'ah ah ah, you didn't say the magic word' on a wrong password (prebuilt binary)"
+arch=('x86_64')
+url="https://gitea.weircon.dk/agw/gtk-ahfail"
+license=('AGPL-3.0-only')
+# gst-plugins-bad-libs: libgstplayer. gst-plugins-base/-good are runtime plugins
+# (audio conversion, the mpg123 mp3 decoder) that namcap cannot see being used.
+depends=('gtk3' 'gtk-session-lock' 'gstreamer' 'gst-plugins-bad-libs' 'gst-plugins-base'
+         'gst-plugins-good' 'pam' 'glib2' 'gdk-pixbuf2' 'cairo' 'pango' 'at-spi2-core' 'gst-plugins-base-libs' 'glibc' 'libgcc' 'libx11')
+optdepends=('pipewire-pulse: raise the volume to 100% on a failed attempt (or libpulse)'
+            'libpulse: raise the volume to 100% on a failed attempt'
+            'swayidle: lock automatically on Wayland'
+            'xss-lock: lock automatically on X11'
+            'gtklock: legacy gtklock module (/usr/lib/gtklock/ahfail-module.so)')
+provides=("ahfail=$pkgver")
+conflicts=('ahfail')
+backup=('etc/pam.d/ahfail')
+install=ahfail.install
+options=('!strip' '!debug')
+source=("https://asger.weirsoe.dk/tarballz/@TARBALL@")
+sha256sums=('@SHA256@')
+
+package() {
+    # The tarball is a staged `meson install` tree: usr/ and etc/ at its root.
+    cp -a "$srcdir/usr" "$srcdir/etc" "$pkgdir/"
+}
@@ -0,0 +1,29 @@
+_ahfail_msg() {
+    cat <<'MSG'
+==> ahfail is its own screen locker and uses its own PAM service (/etc/pam.d/ahfail).
+    Nothing in your other PAM files has been changed.
+
+    Check your setup:      ahfail doctor
+    See the effect safely: ahfail test
+    Lock the screen:       ahfail
+
+    Lock automatically:
+      Wayland: swayidle -w timeout 300 'ahfail' before-sleep 'ahfail'
+      X11:     xss-lock -- ahfail
+
+    The old PAM hook (auth optional .../libahfail_pam.so in e.g. /etc/pam.d/i3lock)
+    is no longer needed with `ahfail`. Remove that line yourself if you added it.
+MSG
+}
+
+post_install() {
+    _ahfail_msg
+}
+
+post_upgrade() {
+    # Only when coming from before 0.10.0, when ahfail became its own locker;
+    # repeating the message on every update would just teach people to skip it.
+    if (( $(vercmp "$2" 0.10.0) < 0 )); then
+        _ahfail_msg
+    fi
+}