Replace bare config snippets with actual tee -a commands so there is no
way to mistake a file entry for a shell command to run directly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Without it meson defaults to /usr/local, so the installed paths don't
match the README and DEFAULT_PATH compiled into the PAM module is wrong.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Linux x86_64 binary install covers both Wayland and X11 from the same
tarball — clarified with a table showing which file is used by which.
macOS section now leads with Homebrew (brew tap + brew install) as the
recommended path, with script and manual install as fallbacks.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
After uploading the release asset, the workflow now:
1. Computes the SHA256 of the source tarball from the Gitea archive endpoint
2. Clones homebrew-ahfail via token auth, patches url + sha256 in Formula/ahfail.rb
3. Commits and pushes — so `brew upgrade ahfail` works without any manual steps
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Apple Silicon Homebrew uses /opt/homebrew as prefix, so hardcoding
/usr/local/lib/ahfail/ahfail-display as DEFAULT_PATH breaks there.
build.rs now falls back to /usr/local/lib on macOS and /usr/lib on Linux
when AHFAIL_LIBDIR is not set; macOS uses the same concat!(env!(...))
approach as Linux.
install-macos.sh passes -Dlibdir so the baked-in path matches INSTALL_DIR.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Clarify that the sprite is the author's face on Nedry's body
- Explicit Wayland (gtklock module) vs X11/macOS (PAM module) comparison table
with an explanation of how each integration works
- Accurate per-distro PAM paths (standard/Fedora multilib/Debian multiarch)
- scripts/install-macos.sh: one-shot installer for macOS — checks Homebrew,
installs brew deps, builds from source, copies binaries, and patches
/etc/pam.d/screensaverui (or screensaver) after the last auth line
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces the manual curl-based release creation with the standard action,
consistent with other Gitea repos. Also bumps checkout to @v4.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
dlopen with a bare filename searches LD_LIBRARY_PATH/ld.so cache, not the
build dir. Using the explicit absolute path avoids the lookup failure.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ahfail_tests.rs calls on_activation which initialises GTK — needs a virtual
display in CI just like the Meson test step.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ubuntu-latest now resolves to Ubuntu 24.04 which ships meson 1.3.2 (satisfies
>=1.3.0) and enforces PEP 668, blocking pip3 install without --break-system-packages.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Volume lock file now stores {pid}:{volume}:{muted} instead of "1":
- Allows recovery of saved volume state if the holder is SIGKILLed
- On stale lock detection (holder PID not alive), inherit saved volume state
and take ownership — prevents permanent volume loss and infinite lockout
PAM module DEFAULT_PATH now baked in at build time via AHFAIL_LIBDIR env var
passed by Meson, fixing the wrong path on multiarch Debian/Ubuntu where libdir
is /usr/lib/x86_64-linux-gnu rather than /usr/lib.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Implements a C-ABI PAM shared library that registers a pam_set_data
cleanup callback to detect auth failures and spawn/kill ahfail-display
via a double-fork, without ever touching credentials.
Implements the ahfail-display binary crate: GTK popup window that spawns
the Nedry sprite and plays the audio clip, with SIGTERM handling, 15-minute
failsafe, deadzone CLI parsing, volume save/restore, and update check.
Adds a build.rs that compiles GResources via glib-compile-resources so the
binary can be built with plain `cargo build` outside of Meson.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
On the first failed unlock attempt, save the current system volume and
mute state then set volume to maximum unmuted; restore on g_module_unload.
A lock file under XDG_RUNTIME_DIR prevents double-acquisition when
multiple gtklock windows are active.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces the single-crate Cargo.toml with a workspace containing
ahfail-gtklock (migrated from root src/) and three stub crates
(ahfail-ui, ahfail-pam, ahfail-display). Updates meson.build to
build with -p ahfail-gtklock.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
