Link the project page from the readme

The page on asger.weirsøe.dk tells the story behind ahfail and links back here.

Claude-Session: https://claude.ai/code/session_012LCTmU2ewo8tnM1dByYAoG

.gitea/workflows/aur-publish.yml

@@ -4,9 +4,25 @@ on:
   push:
     tags:
       - 'v*'
+  # Re-publish without a new upstream release, e.g. a PKGBUILD-only fix:
+  # run it on master with the released version and the next pkgrel.
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Released version to package, without the v (e.g. 1.2.3)'
+        required: true
+      pkgrel:
+        description: 'Package release number'
+        required: true
+        default: '1'
+      packages:
+        description: 'Which AUR packages: both, source (ahfail) or bin (ahfail-bin)'
+        required: true
+        default: 'both'
 
 jobs:
   aur:
+    if: github.event_name != 'workflow_dispatch' || inputs.packages != 'bin'
     runs-on: ubuntu-latest
     container:
       image: archlinux:base-devel
@@ -19,9 +35,16 @@ jobs:
       - name: Extract version from tag
         id: version
         run: |
-          TAG="${GITHUB_REF#refs/tags/v}"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-          echo "version=$TAG" >> "$GITHUB_OUTPUT"
+            VERSION="${{ inputs.version }}"
-          echo "Publishing ahfail v$TAG to AUR"
+            PKGREL="${{ inputs.pkgrel }}"
+          else
+            VERSION="${GITHUB_REF#refs/tags/v}"
+            PKGREL=1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "pkgrel=$PKGREL" >> "$GITHUB_OUTPUT"
+          echo "Publishing $VERSION-$PKGREL to AUR"
 
       - name: Configure SSH for AUR
         run: |
@@ -59,7 +82,7 @@ jobs:
         run: |
           cp packaging/aur/PKGBUILD packaging/aur/ahfail.install aur-pkg/
           sed -i "s/^pkgver=.*/pkgver=${{ steps.version.outputs.version }}/" aur-pkg/PKGBUILD
-          sed -i "s/^pkgrel=.*/pkgrel=1/" aur-pkg/PKGBUILD
+          sed -i "s/^pkgrel=.*/pkgrel=${{ steps.version.outputs.pkgrel }}/" aur-pkg/PKGBUILD
 
       - name: Update checksums and regenerate .SRCINFO
         run: |
@@ -78,7 +101,7 @@ jobs:
             echo "No changes — nothing to push."
             exit 0
           fi
-          git commit -m "Update to ${{ steps.version.outputs.version }}"
+          git commit -m "Update to ${{ steps.version.outputs.version }}-${{ steps.version.outputs.pkgrel }}"
           git push -u origin master
 
       # Mirror the same PKGBUILD to https://asger.weirsøe.dk/tarballz/, the
@@ -93,4 +116,132 @@ jobs:
           printf '%s\n' "$TARBALLZ_SSH_KEY" > ~/.ssh/tarballz
           chmod 600 ~/.ssh/tarballz
           ssh -i ~/.ssh/tarballz -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            root@192.168.10.148 < aur-pkg/PKGBUILD
+            "${{ secrets.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD
+
+  # ahfail-bin: the same release, prebuilt. The binary is built from the TAG
+  # (also when this runs by hand from master), staged as a `meson install` tree,
+  # hosted on https://asger.weirsøe.dk/tarballz/ next to the other packages, and
+  # the AUR package only unpacks it.
+  aur-bin:
+    if: github.event_name != 'workflow_dispatch' || inputs.packages != 'source'
+    runs-on: ubuntu-latest
+    container:
+      image: archlinux:base-devel
+    steps:
+      - name: Install build and packaging tools
+        run: >
+          pacman -Syu --noconfirm --needed git openssh nodejs sudo pacman-contrib curl
+          rust meson ninja gtk3 gtk-session-lock gstreamer gst-plugins-base
+          gst-plugins-good gst-plugins-bad-libs pam
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Resolve version
+        id: version
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            VERSION="${{ inputs.version }}"
+            PKGREL="${{ inputs.pkgrel }}"
+          else
+            VERSION="${GITHUB_REF#refs/tags/v}"
+            PKGREL=1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "pkgrel=$PKGREL" >> "$GITHUB_OUTPUT"
+
+      - name: Build the tagged source into a staged tree
+        run: |
+          # The packaging files come from this checkout; the binary from the tag.
+          cp -r packaging/aur-bin /tmp/aur-bin
+          git -c advice.detachedHead=false checkout "v${{ steps.version.outputs.version }}"
+          meson setup build --prefix=/usr --buildtype=release -Dupdate_check=false
+          meson compile -C build
+          DESTDIR="$PWD/stage" meson install -C build
+          find stage -type f | sort
+
+      - name: Pack the tarball
+        id: tarball
+        run: |
+          # Reproducible-ish: fixed owner, sorted entries, mtime of the tagged commit.
+          EPOCH="$(git log -1 --format=%ct)"
+          tar --sort=name --owner=0 --group=0 --numeric-owner --mtime="@$EPOCH" \
+              --zstd -cf ahfail.tar.zst -C stage usr etc
+          SHA="$(sha256sum ahfail.tar.zst | cut -d' ' -f1)"
+          # The hash is part of the name, so a published name never changes bytes.
+          NAME="ahfail-${{ steps.version.outputs.version }}-${SHA:0:12}-x86_64.tar.zst"
+          mv ahfail.tar.zst "$NAME"
+          echo "name=$NAME" >> "$GITHUB_OUTPUT"
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+          ls -l "$NAME"
+
+      - name: Upload the tarball to tarballz
+        env:
+          TARBALLZ_BIN_SSH_KEY: ${{ secrets.TARBALLZ_BIN_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          printf '%s\n' "$TARBALLZ_BIN_SSH_KEY" > ~/.ssh/tarballz-bin
+          chmod 600 ~/.ssh/tarballz-bin
+          # Forced command on the web host: this key may only write ahfail-*.tar.*
+          # and ahfail-bin.PKGBUILD, and keeps the newest three tarballs.
+          ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
+            "${{ secrets.TARBALLZ_TARGET }}" "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}"
+
+      - name: Verify the public URL serves the same bytes
+        run: |
+          URL="https://asger.weirsoe.dk/tarballz/${{ steps.tarball.outputs.name }}"
+          GOT="$(curl -fsSL --retry 3 "$URL" | sha256sum | cut -d' ' -f1)"
+          if [ "$GOT" != "${{ steps.tarball.outputs.sha }}" ]; then
+            echo "error: $URL does not serve the uploaded tarball" >&2
+            exit 1
+          fi
+
+      - name: Configure SSH for AUR
+        run: |
+          echo "${{ secrets.AUR_SSH_PRIVATE_KEY }}" > ~/.ssh/aur
+          chmod 600 ~/.ssh/aur
+          ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
+          cat > ~/.ssh/config <<'EOF'
+          Host aur.archlinux.org
+            User aur
+            IdentityFile ~/.ssh/aur
+            StrictHostKeyChecking accept-new
+          EOF
+          useradd -m builder
+
+      - name: Render PKGBUILD and .SRCINFO
+        run: |
+          git clone ssh://aur@aur.archlinux.org/ahfail-bin.git aur-bin-pkg 2>&1 || true
+          if [ ! -d aur-bin-pkg/.git ]; then
+            mkdir -p aur-bin-pkg && cd aur-bin-pkg
+            git init -b master
+            git remote add origin ssh://aur@aur.archlinux.org/ahfail-bin.git
+            cd ..
+          fi
+          cp /tmp/aur-bin/PKGBUILD /tmp/aur-bin/ahfail.install aur-bin-pkg/
+          cd aur-bin-pkg
+          sed -i "s/@TARBALL@/${{ steps.tarball.outputs.name }}/g; s/@SHA256@/${{ steps.tarball.outputs.sha }}/" PKGBUILD
+          sed -i "s/^pkgver=.*/pkgver=${{ steps.version.outputs.version }}/; s/^pkgrel=.*/pkgrel=${{ steps.version.outputs.pkgrel }}/" PKGBUILD
+          chown -R builder: .
+          sudo -u builder makepkg --printsrcinfo > .SRCINFO
+          cat PKGBUILD | tail -20
+
+      - name: Commit and push to AUR
+        run: |
+          cd aur-bin-pkg
+          git config user.name "Asger Geel Weirsoe"
+          git config user.email "asger@weircon.dk"
+          git add PKGBUILD .SRCINFO ahfail.install
+          if git diff --staged --quiet; then
+            echo "No changes, nothing to push."
+            exit 0
+          fi
+          git commit -m "Update to ${{ steps.version.outputs.version }}-${{ steps.version.outputs.pkgrel }}"
+          git push -u origin master
+
+      - name: Publish PKGBUILD to the tarballz index
+        continue-on-error: true
+        run: |
+          ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
+            "${{ secrets.TARBALLZ_TARGET }}" < aur-bin-pkg/PKGBUILD

.gitea/workflows/release.yml

@@ -52,35 +52,23 @@ jobs:
           files: ahfail-linux-x86_64.tar.gz
 
       - name: Update Homebrew tap
-        # git over HTTP is disabled on this Gitea on purpose, so the formula is
+        # The tap lives on GitHub (asger-weirsoee/homebrew-tap): Homebrew cannot
-        # updated through the contents API instead of a clone and push.
+        # clone from this Gitea, where git over HTTP is disabled. The deploy key
+        # can write only to that one repository; the tap's Actions then build
+        # and test the formula on a real Mac.
         env:
-          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          HOMEBREW_TAP_DEPLOY_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
           TAG: ${{ github.ref_name }}
-          API: ${{ github.server_url }}/api/v1/repos/agw/homebrew-ahfail/contents/Formula/ahfail.rb
         run: |
-          python3 - <<'PY'
+          set -euo pipefail
-          import base64, json, os, re, urllib.request
+          mkdir -p ~/.ssh
-
+          printf '%s\n' "$HOMEBREW_TAP_DEPLOY_KEY" > ~/.ssh/tap
-          api, token, tag = os.environ["API"], os.environ["RELEASE_TOKEN"], os.environ["TAG"]
+          chmod 600 ~/.ssh/tap
-          sha256 = os.environ["SOURCE_SHA256"]
+          export GIT_SSH_COMMAND="ssh -i ~/.ssh/tap -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
-          headers = {"Authorization": f"token {token}", "Content-Type": "application/json"}
+          git clone -q git@github.com:asger-weirsoee/homebrew-tap.git tap
-
+          cd tap
-          with urllib.request.urlopen(urllib.request.Request(api, headers=headers)) as r:
+          URL="https://gitea.weircon.dk/agw/gtk-ahfail/archive/${TAG}.tar.gz"
-              current = json.load(r)
+          sed -i "s|^  url \".*\"|  url \"$URL\"|; s|^  sha256 \".*\"|  sha256 \"${SOURCE_SHA256}\"|" Formula/ahfail.rb
-          formula = base64.b64decode(current["content"]).decode()
+          if git diff --quiet; then echo "formula already up to date"; exit 0; fi
-          new = re.sub(r'url ".*?"', f'url "https://gitea.weircon.dk/agw/gtk-ahfail/archive/{tag}.tar.gz"', formula, count=1)
+          git -c user.name="Asger Geel Weirsøe" -c user.email="github@weircon.dk" commit -q -am "ahfail ${TAG#v}"
-          new = re.sub(r'sha256 ".*?"', f'sha256 "{sha256}"', new, count=1)
+          git push -q origin HEAD
-          if new == formula:
-              print("formula already up to date")
-              raise SystemExit(0)
-
-          body = json.dumps({
-              "content": base64.b64encode(new.encode()).decode(),
-              "sha": current["sha"],
-              "message": f"chore: update ahfail to {tag}",
-          }).encode()
-          req = urllib.request.Request(api, data=body, headers=headers, method="PUT")
-          with urllib.request.urlopen(req) as r:
-              print("formula updated:", r.status)
-          PY

Cargo.lock

@@ -10,7 +10,7 @@ checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "ahfail"
-version = "0.10.0"
+version = "0.10.2"
 dependencies = [
  "ahfail-ui",
  "cc",

crates/ahfail/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ahfail"
-version = "0.10.0"
+version = "0.10.2"
 edition = "2021"
 description = "Screen locker that says ah ah ah when you get the password wrong"
 license = "AGPL-3.0-only"

meson.build

@@ -1,7 +1,7 @@
 project(
   'ahfail',
   ['c', 'rust'],
-  version: '0.10.0',
+  version: '0.10.2',
   meson_version: '>=1.3.0',
   default_options: ['warning_level=3', 'c_std=c11']
 )
@@ -9,17 +9,7 @@ project(
 ahfail_inc = include_directories('include')
 
 cc = meson.get_compiler('c')
-m_dep = cc.find_library('m', required : false)
+is_linux = host_machine.system() == 'linux'
-gtk_dep = dependency('gtk+-3.0')
-gstplayer_dep = dependency('gstreamer-player-1.0')
-gnome = import('gnome')
-
-resources = gnome.compile_resources(
-  'ahfail-resources',
-  'assets/ahfail.gresource.xml',
-  source_dir: 'assets',
-  c_name: 'ahfail'
-)
 
 # All Rust artefacts come from ONE cargo invocation with one target directory.
 # Four separate builds with four target directories compiled the whole GTK and
@@ -30,16 +20,29 @@ resources = gnome.compile_resources(
 # client is not compiled in at all.
 cargo_features = get_option('update_check') ? '' : '--no-default-features'
 
-# The ahfail command is the Linux locker (Wayland/X11 + its own PAM service).
+# Linux builds everything: the ahfail locker, the gtklock module (Wayland), the
-# macOS keeps the PAM hook and is built without it until it has been tested there.
+# PAM hook and its display binary. macOS only has the PAM hook + display binary:
-is_linux = host_machine.system() == 'linux'
+# gtklock and the locker are Linux-only, and the module's GNU-ld link flags do
-cargo_pkgs = '-p ahfail-gtklock -p ahfail-pam -p ahfail-display' + (is_linux ? ' -p ahfail' : '')
+# not exist on macOS.
-cargo_outputs = ['libahfail_module.a', 'libahfail_pam.so', 'ahfail-display'] + (is_linux ? ['ahfail'] : [])
+# Cargo names a cdylib .dylib on macOS. The installed name stays
-cargo_install_dirs = [false, get_option('libdir') / 'ahfail', get_option('libdir') / 'ahfail'] + (is_linux ? [get_option('bindir')] : [])
+# libahfail_pam.so: PAM loads the module by path, whatever the extension.
-cargo_copy = (' && cp "@OUTDIR@/target/release/libahfail_module.a" "@OUTPUT0@"'
+pam_built = host_machine.system() == 'darwin' ? 'libahfail_pam.dylib' : 'libahfail_pam.so'
-  + ' && cp "@OUTDIR@/target/release/libahfail_pam.so" "@OUTPUT1@"'
+if is_linux
-  + ' && cp "@OUTDIR@/target/release/ahfail-display" "@OUTPUT2@"'
+  cargo_pkgs = '-p ahfail-gtklock -p ahfail-pam -p ahfail-display -p ahfail'
-  + (is_linux ? ' && cp "@OUTDIR@/target/release/ahfail" "@OUTPUT3@"' : ''))
+  cargo_outputs = ['libahfail_module.a', 'libahfail_pam.so', 'ahfail-display', 'ahfail']
+  # module archive: linked below, not installed; PAM hook + display: libdir/ahfail; locker: bindir.
+  cargo_install_dirs = [false, get_option('libdir') / 'ahfail', get_option('libdir') / 'ahfail', get_option('bindir')]
+  cargo_copy = (' && cp "@OUTDIR@/target/release/libahfail_module.a" "@OUTPUT0@"'
+    + ' && cp "@OUTDIR@/target/release/libahfail_pam.so" "@OUTPUT1@"'
+    + ' && cp "@OUTDIR@/target/release/ahfail-display" "@OUTPUT2@"'
+    + ' && cp "@OUTDIR@/target/release/ahfail" "@OUTPUT3@"')
+else
+  cargo_pkgs = '-p ahfail-pam -p ahfail-display'
+  cargo_outputs = ['libahfail_pam.so', 'ahfail-display']
+  cargo_install_dirs = [get_option('libdir') / 'ahfail', get_option('libdir') / 'ahfail']
+  cargo_copy = (' && cp "@OUTDIR@/target/release/' + pam_built + '" "@OUTPUT0@"'
+    + ' && cp "@OUTDIR@/target/release/ahfail-display" "@OUTPUT1@"')
+endif
 
 cargo_all = custom_target(
   'ahfail-cargo-build',
@@ -58,13 +61,10 @@ cargo_all = custom_target(
   build_by_default: true,
   build_always_stale: true,  # cargo decides what is out of date, not meson
   install: true,
-  # module archive: linked below, not installed; PAM module + display binary:
-  # libdir/ahfail; the ahfail command: bindir.
   install_dir: cargo_install_dirs,
   install_mode: 'rwxr-xr-x'
 )
-cargo_target = cargo_all[0]
+pam_cargo = is_linux ? cargo_all[1] : cargo_all[0]
-pam_cargo = cargo_all[1]
 
 # The locker's own PAM service. Shipped as its own file, like swaylock and
 # gtklock do, so no other package's PAM configuration is ever touched.
@@ -75,33 +75,46 @@ if is_linux
   )
 endif
 
-libahfail = shared_library(
+if is_linux
-  'ahfail-module',
+  m_dep = cc.find_library('m', required : false)
-  resources,
+  gtk_dep = dependency('gtk+-3.0')
-  link_args: ['-Wl,--whole-archive', meson.current_build_dir() / 'libahfail_module.a', '-Wl,--no-whole-archive'],
+  gstplayer_dep = dependency('gstreamer-player-1.0')
-  link_depends: cargo_target,
+  resources = import('gnome').compile_resources(
-  include_directories: ahfail_inc,
+    'ahfail-resources',
-  dependencies: [gtk_dep, gstplayer_dep, m_dep],
+    'assets/ahfail.gresource.xml',
-  install: true,
+    source_dir: 'assets',
-  install_dir: get_option('libdir') / 'gtklock',
+    c_name: 'ahfail'
-  name_prefix: ''
+  )
-)
 
-smoke = executable(
+  # The gtklock module (Wayland): the Rust staticlib linked whole into a .so.
-  'module_smoke_test',
+  libahfail = shared_library(
-  'tests/module_test.c',
+    'ahfail-module',
-  include_directories: ahfail_inc,
+    resources,
-  link_with: libahfail,
+    link_args: ['-Wl,--whole-archive', meson.current_build_dir() / 'libahfail_module.a', '-Wl,--no-whole-archive'],
-  dependencies: [gtk_dep, gstplayer_dep]
+    link_depends: cargo_all[0],
-)
+    include_directories: ahfail_inc,
+    dependencies: [gtk_dep, gstplayer_dep, m_dep],
+    install: true,
+    install_dir: get_option('libdir') / 'gtklock',
+    name_prefix: ''
+  )
 
-test('module symbols', smoke)
+  smoke = executable(
+    'module_smoke_test',
+    'tests/module_test.c',
+    include_directories: ahfail_inc,
+    link_with: libahfail,
+    dependencies: [gtk_dep, gstplayer_dep]
+  )
+
+  test('module symbols', smoke)
+endif
 
 # PAM module smoke test: dlopen libahfail_pam.so and verify pam_sm_authenticate is exported.
 pam_smoke = executable(
   'pam_smoke_test',
   'tests/pam_smoke_test.c',
-  dependencies: [cc.find_library('dl', required: true)]
+  dependencies: [cc.find_library('dl', required: false)]  # part of libSystem on macOS
 )
 
 test('pam symbols', pam_smoke,

packaging/aur-bin/PKGBUILD

@@ -0,0 +1,58 @@
+# Maintainer: Asger Geel Weirsoe <asger at weircon dot dk>
+#
+# DISCLAIMER
+#
+# ahfail is a joke with a real screen locker underneath. Two things to know
+# before installing it:
+#
+# 1. Security. It sits in the authentication path of your session. It is
+#    provided as is, without any warranty (see the AGPL-3.0 license). On
+#    Wayland a crash leaves the session locked; on X11, as with i3lock, a
+#    killed locker leaves it open. /etc/pam.d/ahfail includes `login`, so
+#    the system's pam_faillock policy applies to wrong guesses.
+#
+# 2. Media. The sprite frames and the audio clip are a parody of the
+#    "ah ah ah, you didn't say the magic word" scene from Jurassic Park
+#    (1993). The film and its characters belong to their respective rights
+#    holders; they are used here non-commercially for parody, and the
+#    AGPL-3.0 license covers the code, not those assets. Rights holders who
+#    object can reach the maintainer at the address above and the assets
+#    will be replaced.
+#
+# PROVENANCE OF THE BINARY
+#
+# Built by the gtk-ahfail release workflow from the tagged source, in an
+# archlinux:base-devel container, with --prefix=/usr and without the Gitea
+# update check. The same recipe builds the source package `ahfail`.
+#
+#   build recipe:  https://gitea.weircon.dk/agw/gtk-ahfail
+#   download:      https://asger.weirsoe.dk/tarballz/@TARBALL@
+
+pkgname=ahfail-bin
+pkgver=0.0.0
+pkgrel=1
+pkgdesc="Screen locker that says 'ah ah ah, you didn't say the magic word' on a wrong password (prebuilt binary)"
+arch=('x86_64')
+url="https://asger.weirsøe.dk/en/projects/ahfail"
+license=('AGPL-3.0-only')
+# gst-plugins-bad-libs: libgstplayer. gst-plugins-base/-good are runtime plugins
+# (audio conversion, the mpg123 mp3 decoder) that namcap cannot see being used.
+depends=('gtk3' 'gtk-session-lock' 'gstreamer' 'gst-plugins-bad-libs' 'gst-plugins-base'
+         'gst-plugins-good' 'pam' 'glib2' 'gdk-pixbuf2' 'cairo' 'pango' 'at-spi2-core' 'gst-plugins-base-libs' 'glibc' 'libgcc' 'libx11')
+optdepends=('pipewire-pulse: raise the volume to 100% on a failed attempt (or libpulse)'
+            'libpulse: raise the volume to 100% on a failed attempt'
+            'swayidle: lock automatically on Wayland'
+            'xss-lock: lock automatically on X11'
+            'gtklock: legacy gtklock module (/usr/lib/gtklock/ahfail-module.so)')
+provides=("ahfail=$pkgver")
+conflicts=('ahfail')
+backup=('etc/pam.d/ahfail')
+install=ahfail.install
+options=('!strip' '!debug')
+source=("https://asger.weirsoe.dk/tarballz/@TARBALL@")
+sha256sums=('@SHA256@')
+
+package() {
+    # The tarball is a staged `meson install` tree: usr/ and etc/ at its root.
+    cp -a "$srcdir/usr" "$srcdir/etc" "$pkgdir/"
+}

packaging/aur-bin/ahfail.install

@@ -0,0 +1,29 @@
+_ahfail_msg() {
+    cat <<'MSG'
+==> ahfail is its own screen locker and uses its own PAM service (/etc/pam.d/ahfail).
+    Nothing in your other PAM files has been changed.
+
+    Check your setup:      ahfail doctor
+    See the effect safely: ahfail test
+    Lock the screen:       ahfail
+
+    Lock automatically:
+      Wayland: swayidle -w timeout 300 'ahfail' before-sleep 'ahfail'
+      X11:     xss-lock -- ahfail
+
+    The old PAM hook (auth optional .../libahfail_pam.so in e.g. /etc/pam.d/i3lock)
+    is no longer needed with `ahfail`. Remove that line yourself if you added it.
+MSG
+}
+
+post_install() {
+    _ahfail_msg
+}
+
+post_upgrade() {
+    # Only when coming from before 0.10.0, when ahfail became its own locker;
+    # repeating the message on every update would just teach people to skip it.
+    if (( $(vercmp "$2" 0.10.0) < 0 )); then
+        _ahfail_msg
+    fi
+}

packaging/aur/PKGBUILD

@@ -1,4 +1,5 @@
-# Maintainer: Asger Geel Weirsoe <asger@weircon.dk>
+# Maintainer: Asger Geel Weirsoe <asger at weircon dot dk>
+#   build recipe:  https://gitea.weircon.dk/agw/gtk-ahfail
 #
 # DISCLAIMER
 #
@@ -23,7 +24,8 @@ pkgver=0.0.0
 pkgrel=1
 pkgdesc="Screen locker that says 'ah ah ah, you didn't say the magic word' on a wrong password"
 arch=('x86_64')
-url="https://gitea.weircon.dk/agw/gtk-ahfail"
+url="https://asger.weirsøe.dk/en/projects/ahfail"
+_repo="https://gitea.weircon.dk/agw/gtk-ahfail"
 license=('AGPL-3.0-only')
 # gst-plugins-bad-libs: libgstplayer. gst-plugins-base/-good are runtime plugins
 # (audio conversion, the mpg123 mp3 decoder) that namcap cannot see being used.
@@ -38,7 +40,7 @@ optdepends=('pipewire-pulse: raise the volume to 100% on a failed attempt (or li
 backup=('etc/pam.d/ahfail')
 install=ahfail.install
 options=('!lto')
-source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
+source=("$pkgname-$pkgver.tar.gz::$_repo/archive/v$pkgver.tar.gz")
 sha256sums=('SKIP')
 
 prepare() {

readme.md

@@ -10,6 +10,8 @@ ahfail doctor   # check this machine and explain what is missing
 
 One command on Linux: `ahfail` works out whether you run Wayland or X11 and does the right thing. On macOS the effect comes from a PAM hook on the system lock screen (see below).
 
+Project page, with the story behind it: [asger.weirsøe.dk/en/projects/ahfail](https://asger.xn--weirse-fya.dk/en/projects/ahfail)
+
 ---
 
 > **Security disclaimer**
@@ -81,7 +83,7 @@ Pass `--no-max-volume` to leave the volume alone.
 ### Homebrew (recommended)
 
 ```bash
-brew tap agw/ahfail https://gitea.weircon.dk/agw/homebrew-ahfail
+brew tap asger-weirsoee/tap
 brew install ahfail
 ```