Add a disclaimer to the PKGBUILD and build the locker on Linux only

The PKGBUILD states what the package is: a real screen locker provided
as is, and parody media from Jurassic Park that the AGPL does not cover.
The ahfail command has only been tested on Linux, so macOS builds keep
the PAM hook and skip it; the README no longer promises it there.

Claude-Session: https://claude.ai/code/session_012LCTmU2ewo8tnM1dByYAoG

meson.build

@@ -30,29 +30,37 @@ resources = gnome.compile_resources(
 # client is not compiled in at all.
 cargo_features = get_option('update_check') ? '' : '--no-default-features'
 
+# The ahfail command is the Linux locker (Wayland/X11 + its own PAM service).
+# macOS keeps the PAM hook and is built without it until it has been tested there.
+is_linux = host_machine.system() == 'linux'
+cargo_pkgs = '-p ahfail-gtklock -p ahfail-pam -p ahfail-display' + (is_linux ? ' -p ahfail' : '')
+cargo_outputs = ['libahfail_module.a', 'libahfail_pam.so', 'ahfail-display'] + (is_linux ? ['ahfail'] : [])
+cargo_install_dirs = [false, get_option('libdir') / 'ahfail', get_option('libdir') / 'ahfail'] + (is_linux ? [get_option('bindir')] : [])
+cargo_copy = (' && cp "@OUTDIR@/target/release/libahfail_module.a" "@OUTPUT0@"'
+  + ' && cp "@OUTDIR@/target/release/libahfail_pam.so" "@OUTPUT1@"'
+  + ' && cp "@OUTDIR@/target/release/ahfail-display" "@OUTPUT2@"'
+  + (is_linux ? ' && cp "@OUTDIR@/target/release/ahfail" "@OUTPUT3@"' : ''))
+
 cargo_all = custom_target(
   'ahfail-cargo-build',
   input: ['Cargo.toml', 'Cargo.lock'],
-  output: ['libahfail_module.a', 'libahfail_pam.so', 'ahfail-display', 'ahfail'],
+  output: cargo_outputs,
   command: [
     'sh', '-c',
     # The PAM module's build.rs needs the absolute libdir to know where
     # ahfail-display is installed; get_option('libdir') alone is relative.
     'AHFAIL_LIBDIR=' + get_option('prefix') / get_option('libdir')
     + ' cargo build --release --locked'
-    + ' -p ahfail-gtklock -p ahfail-pam -p ahfail-display -p ahfail ' + cargo_features
+    + ' ' + cargo_pkgs + ' ' + cargo_features
     + ' --target-dir "@OUTDIR@/target"'
-    + ' && cp "@OUTDIR@/target/release/libahfail_module.a" "@OUTPUT0@"'
-    + ' && cp "@OUTDIR@/target/release/libahfail_pam.so" "@OUTPUT1@"'
-    + ' && cp "@OUTDIR@/target/release/ahfail-display" "@OUTPUT2@"'
-    + ' && cp "@OUTDIR@/target/release/ahfail" "@OUTPUT3@"'
+    + cargo_copy
   ],
   build_by_default: true,
   build_always_stale: true,  # cargo decides what is out of date, not meson
   install: true,
   # module archive: linked below, not installed; PAM module + display binary:
   # libdir/ahfail; the ahfail command: bindir.
-  install_dir: [false, get_option('libdir') / 'ahfail', get_option('libdir') / 'ahfail', get_option('bindir')],
+  install_dir: cargo_install_dirs,
   install_mode: 'rwxr-xr-x'
 )
 cargo_target = cargo_all[0]
@@ -60,10 +68,12 @@ pam_cargo = cargo_all[1]
 
 # The locker's own PAM service. Shipped as its own file, like swaylock and
 # gtklock do, so no other package's PAM configuration is ever touched.
+if is_linux
   install_data('data/pam.d/ahfail',
     install_dir: get_option('sysconfdir') / 'pam.d',
     install_mode: 'rw-r--r--'
   )
+endif
 
 libahfail = shared_library(
   'ahfail-module',

packaging/aur/PKGBUILD

@@ -1,4 +1,23 @@
 # Maintainer: Asger Geel Weirsoe <asger@weircon.dk>
+#
+# DISCLAIMER
+#
+# ahfail is a joke with a real screen locker underneath. Two things to know
+# before installing it:
+#
+# 1. Security. It sits in the authentication path of your session. It is
+#    provided as is, without any warranty (see the AGPL-3.0 license). On
+#    Wayland a crash leaves the session locked; on X11, as with i3lock, a
+#    killed locker leaves it open. /etc/pam.d/ahfail includes `login`, so
+#    the system's pam_faillock policy applies to wrong guesses.
+#
+# 2. Media. The sprite frames and the audio clip are a parody of the
+#    "ah ah ah, you didn't say the magic word" scene from Jurassic Park
+#    (1993). The film and its characters belong to their respective rights
+#    holders; they are used here non-commercially for parody, and the
+#    AGPL-3.0 license covers the code, not those assets. Rights holders who
+#    object can reach the maintainer at the address above and the assets
+#    will be replaced.
 pkgname=ahfail
 pkgver=0.0.0
 pkgrel=1

readme.md

@@ -8,7 +8,7 @@ ahfail test     # show the effect once, without locking anything
 ahfail doctor   # check this machine and explain what is missing
 ```
 
-One command on every platform: `ahfail` works out whether you run Wayland or X11 (or macOS) and does the right thing.
+One command on Linux: `ahfail` works out whether you run Wayland or X11 and does the right thing. On macOS the effect comes from a PAM hook on the system lock screen (see below).
 
 ---
 
@@ -51,7 +51,7 @@ Then run `ahfail doctor`. It tells you whether the session type is supported, wh
 |---|---|---|
 | Linux, **Wayland** | ext-session-lock-v1 (through gtk-session-lock) | sway, Hyprland, niri, river, labwc and KDE Plasma 6. **Not GNOME**: GNOME does not let third-party programs lock the screen. |
 | Linux, **X11** | full-screen windows on every monitor plus a keyboard and pointer grab | The i3lock model. Works with any X11 window manager. |
-| **macOS** | the system lock screen | `ahfail` asks macOS to lock; the effect comes from the PAM hook installed via Homebrew (see below). |
+| **macOS** | the system lock screen | Lock the Mac as usual; the effect comes from the PAM hook installed via Homebrew (see below). The `ahfail` command itself is Linux only for now. |
 
 ## Locking automatically
 
@@ -85,7 +85,7 @@ brew tap agw/ahfail https://gitea.weircon.dk/agw/homebrew-ahfail
 brew install ahfail
 ```
 
-After install, Homebrew prints the PAM line to add to `/etc/pam.d/screensaverui` (macOS 13+) or `/etc/pam.d/screensaver` (macOS 12 and earlier). That one-line edit is the only manual step. Enable "Require password immediately" in System Settings so `ahfail` actually locks.
+After install, Homebrew prints the PAM line to add to `/etc/pam.d/screensaverui` (macOS 13+) or `/etc/pam.d/screensaver` (macOS 12 and earlier). That one-line edit is the only manual step. Enable "Require password immediately" in System Settings so the lock screen asks for the password straight away.
 
 To upgrade: `brew upgrade ahfail`. To uninstall: `sudo sed -i '' '/ahfail/d' /etc/pam.d/screensaverui` (or `screensaver`), then `brew uninstall ahfail`.