Build the PAM module on macOS (0.10.1)

Cargo names a cdylib .dylib on macOS, so copying libahfail_pam.so out of
the target directory failed there, as the first real macOS build in the
Homebrew tap's Actions showed. The installed name stays .so.

Claude-Session: https://claude.ai/code/session_012LCTmU2ewo8tnM1dByYAoG

.gitea/workflows/aur-publish.yml

@@ -4,9 +4,25 @@ on:
   push:
     tags:
       - 'v*'
+  # Re-publish without a new upstream release, e.g. a PKGBUILD-only fix:
+  # run it on master with the released version and the next pkgrel.
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Released version to package, without the v (e.g. 1.2.3)'
+        required: true
+      pkgrel:
+        description: 'Package release number'
+        required: true
+        default: '1'
+      packages:
+        description: 'Which AUR packages: both, source (ahfail) or bin (ahfail-bin)'
+        required: true
+        default: 'both'
 
 jobs:
   aur:
+    if: github.event_name != 'workflow_dispatch' || inputs.packages != 'bin'
     runs-on: ubuntu-latest
     container:
       image: archlinux:base-devel
@@ -19,9 +35,16 @@ jobs:
       - name: Extract version from tag
         id: version
         run: |
-          TAG="${GITHUB_REF#refs/tags/v}"
-          echo "version=$TAG" >> "$GITHUB_OUTPUT"
-          echo "Publishing ahfail v$TAG to AUR"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            VERSION="${{ inputs.version }}"
+            PKGREL="${{ inputs.pkgrel }}"
+          else
+            VERSION="${GITHUB_REF#refs/tags/v}"
+            PKGREL=1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "pkgrel=$PKGREL" >> "$GITHUB_OUTPUT"
+          echo "Publishing $VERSION-$PKGREL to AUR"
 
       - name: Configure SSH for AUR
         run: |
@@ -59,7 +82,7 @@ jobs:
         run: |
           cp packaging/aur/PKGBUILD packaging/aur/ahfail.install aur-pkg/
           sed -i "s/^pkgver=.*/pkgver=${{ steps.version.outputs.version }}/" aur-pkg/PKGBUILD
-          sed -i "s/^pkgrel=.*/pkgrel=1/" aur-pkg/PKGBUILD
+          sed -i "s/^pkgrel=.*/pkgrel=${{ steps.version.outputs.pkgrel }}/" aur-pkg/PKGBUILD
 
       - name: Update checksums and regenerate .SRCINFO
         run: |
@@ -78,7 +101,7 @@ jobs:
             echo "No changes — nothing to push."
             exit 0
           fi
-          git commit -m "Update to ${{ steps.version.outputs.version }}"
+          git commit -m "Update to ${{ steps.version.outputs.version }}-${{ steps.version.outputs.pkgrel }}"
           git push -u origin master
 
       # Mirror the same PKGBUILD to https://asger.weirsøe.dk/tarballz/, the
@@ -94,3 +117,131 @@ jobs:
           chmod 600 ~/.ssh/tarballz
           ssh -i ~/.ssh/tarballz -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
             root@192.168.10.148 < aur-pkg/PKGBUILD
+
+  # ahfail-bin: the same release, prebuilt. The binary is built from the TAG
+  # (also when this runs by hand from master), staged as a `meson install` tree,
+  # hosted on https://asger.weirsøe.dk/tarballz/ next to the other packages, and
+  # the AUR package only unpacks it.
+  aur-bin:
+    if: github.event_name != 'workflow_dispatch' || inputs.packages != 'source'
+    runs-on: ubuntu-latest
+    container:
+      image: archlinux:base-devel
+    steps:
+      - name: Install build and packaging tools
+        run: >
+          pacman -Syu --noconfirm --needed git openssh nodejs sudo pacman-contrib curl
+          rust meson ninja gtk3 gtk-session-lock gstreamer gst-plugins-base
+          gst-plugins-good gst-plugins-bad-libs pam
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Resolve version
+        id: version
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            VERSION="${{ inputs.version }}"
+            PKGREL="${{ inputs.pkgrel }}"
+          else
+            VERSION="${GITHUB_REF#refs/tags/v}"
+            PKGREL=1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "pkgrel=$PKGREL" >> "$GITHUB_OUTPUT"
+
+      - name: Build the tagged source into a staged tree
+        run: |
+          # The packaging files come from this checkout; the binary from the tag.
+          cp -r packaging/aur-bin /tmp/aur-bin
+          git -c advice.detachedHead=false checkout "v${{ steps.version.outputs.version }}"
+          meson setup build --prefix=/usr --buildtype=release -Dupdate_check=false
+          meson compile -C build
+          DESTDIR="$PWD/stage" meson install -C build
+          find stage -type f | sort
+
+      - name: Pack the tarball
+        id: tarball
+        run: |
+          # Reproducible-ish: fixed owner, sorted entries, mtime of the tagged commit.
+          EPOCH="$(git log -1 --format=%ct)"
+          tar --sort=name --owner=0 --group=0 --numeric-owner --mtime="@$EPOCH" \
+              --zstd -cf ahfail.tar.zst -C stage usr etc
+          SHA="$(sha256sum ahfail.tar.zst | cut -d' ' -f1)"
+          # The hash is part of the name, so a published name never changes bytes.
+          NAME="ahfail-${{ steps.version.outputs.version }}-${SHA:0:12}-x86_64.tar.zst"
+          mv ahfail.tar.zst "$NAME"
+          echo "name=$NAME" >> "$GITHUB_OUTPUT"
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+          ls -l "$NAME"
+
+      - name: Upload the tarball to tarballz
+        env:
+          TARBALLZ_BIN_SSH_KEY: ${{ secrets.TARBALLZ_BIN_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          printf '%s\n' "$TARBALLZ_BIN_SSH_KEY" > ~/.ssh/tarballz-bin
+          chmod 600 ~/.ssh/tarballz-bin
+          # Forced command on the web host: this key may only write ahfail-*.tar.*
+          # and ahfail-bin.PKGBUILD, and keeps the newest three tarballs.
+          ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
+            root@192.168.10.148 "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}"
+
+      - name: Verify the public URL serves the same bytes
+        run: |
+          URL="https://asger.weirsoe.dk/tarballz/${{ steps.tarball.outputs.name }}"
+          GOT="$(curl -fsSL --retry 3 "$URL" | sha256sum | cut -d' ' -f1)"
+          if [ "$GOT" != "${{ steps.tarball.outputs.sha }}" ]; then
+            echo "error: $URL does not serve the uploaded tarball" >&2
+            exit 1
+          fi
+
+      - name: Configure SSH for AUR
+        run: |
+          echo "${{ secrets.AUR_SSH_PRIVATE_KEY }}" > ~/.ssh/aur
+          chmod 600 ~/.ssh/aur
+          ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
+          cat > ~/.ssh/config <<'EOF'
+          Host aur.archlinux.org
+            User aur
+            IdentityFile ~/.ssh/aur
+            StrictHostKeyChecking accept-new
+          EOF
+          useradd -m builder
+
+      - name: Render PKGBUILD and .SRCINFO
+        run: |
+          git clone ssh://aur@aur.archlinux.org/ahfail-bin.git aur-bin-pkg 2>&1 || true
+          if [ ! -d aur-bin-pkg/.git ]; then
+            mkdir -p aur-bin-pkg && cd aur-bin-pkg
+            git init -b master
+            git remote add origin ssh://aur@aur.archlinux.org/ahfail-bin.git
+            cd ..
+          fi
+          cp /tmp/aur-bin/PKGBUILD /tmp/aur-bin/ahfail.install aur-bin-pkg/
+          cd aur-bin-pkg
+          sed -i "s/@TARBALL@/${{ steps.tarball.outputs.name }}/g; s/@SHA256@/${{ steps.tarball.outputs.sha }}/" PKGBUILD
+          sed -i "s/^pkgver=.*/pkgver=${{ steps.version.outputs.version }}/; s/^pkgrel=.*/pkgrel=${{ steps.version.outputs.pkgrel }}/" PKGBUILD
+          chown -R builder: .
+          sudo -u builder makepkg --printsrcinfo > .SRCINFO
+          cat PKGBUILD | tail -20
+
+      - name: Commit and push to AUR
+        run: |
+          cd aur-bin-pkg
+          git config user.name "Asger Geel Weirsoe"
+          git config user.email "asger@weircon.dk"
+          git add PKGBUILD .SRCINFO ahfail.install
+          if git diff --staged --quiet; then
+            echo "No changes, nothing to push."
+            exit 0
+          fi
+          git commit -m "Update to ${{ steps.version.outputs.version }}-${{ steps.version.outputs.pkgrel }}"
+          git push -u origin master
+
+      - name: Publish PKGBUILD to the tarballz index
+        continue-on-error: true
+        run: |
+          ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
+            root@192.168.10.148 < aur-bin-pkg/PKGBUILD

.gitea/workflows/release.yml

@@ -52,35 +52,23 @@ jobs:
           files: ahfail-linux-x86_64.tar.gz
 
       - name: Update Homebrew tap
-        # git over HTTP is disabled on this Gitea on purpose, so the formula is
-        # updated through the contents API instead of a clone and push.
+        # The tap lives on GitHub (asger-weirsoee/homebrew-tap): Homebrew cannot
+        # clone from this Gitea, where git over HTTP is disabled. The deploy key
+        # can write only to that one repository; the tap's Actions then build
+        # and test the formula on a real Mac.
         env:
-          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          HOMEBREW_TAP_DEPLOY_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
           TAG: ${{ github.ref_name }}
-          API: ${{ github.server_url }}/api/v1/repos/agw/homebrew-ahfail/contents/Formula/ahfail.rb
         run: |
-          python3 - <<'PY'
-          import base64, json, os, re, urllib.request
-
-          api, token, tag = os.environ["API"], os.environ["RELEASE_TOKEN"], os.environ["TAG"]
-          sha256 = os.environ["SOURCE_SHA256"]
-          headers = {"Authorization": f"token {token}", "Content-Type": "application/json"}
-
-          with urllib.request.urlopen(urllib.request.Request(api, headers=headers)) as r:
-              current = json.load(r)
-          formula = base64.b64decode(current["content"]).decode()
-          new = re.sub(r'url ".*?"', f'url "https://gitea.weircon.dk/agw/gtk-ahfail/archive/{tag}.tar.gz"', formula, count=1)
-          new = re.sub(r'sha256 ".*?"', f'sha256 "{sha256}"', new, count=1)
-          if new == formula:
-              print("formula already up to date")
-              raise SystemExit(0)
-
-          body = json.dumps({
-              "content": base64.b64encode(new.encode()).decode(),
-              "sha": current["sha"],
-              "message": f"chore: update ahfail to {tag}",
-          }).encode()
-          req = urllib.request.Request(api, data=body, headers=headers, method="PUT")
-          with urllib.request.urlopen(req) as r:
-              print("formula updated:", r.status)
-          PY
+          set -euo pipefail
+          mkdir -p ~/.ssh
+          printf '%s\n' "$HOMEBREW_TAP_DEPLOY_KEY" > ~/.ssh/tap
+          chmod 600 ~/.ssh/tap
+          export GIT_SSH_COMMAND="ssh -i ~/.ssh/tap -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
+          git clone -q git@github.com:asger-weirsoee/homebrew-tap.git tap
+          cd tap
+          URL="https://gitea.weircon.dk/agw/gtk-ahfail/archive/${TAG}.tar.gz"
+          sed -i "s|^  url \".*\"|  url \"$URL\"|; s|^  sha256 \".*\"|  sha256 \"${SOURCE_SHA256}\"|" Formula/ahfail.rb
+          if git diff --quiet; then echo "formula already up to date"; exit 0; fi
+          git -c user.name="Asger Geel Weirsøe" -c user.email="github@weircon.dk" commit -q -am "ahfail ${TAG#v}"
+          git push -q origin HEAD

Cargo.lock

@@ -10,7 +10,7 @@ checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "ahfail"
-version = "0.10.0"
+version = "0.10.1"
 dependencies = [
  "ahfail-ui",
  "cc",

crates/ahfail/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ahfail"
-version = "0.10.0"
+version = "0.10.1"
 edition = "2021"
 description = "Screen locker that says ah ah ah when you get the password wrong"
 license = "AGPL-3.0-only"

meson.build

@@ -1,7 +1,7 @@
 project(
   'ahfail',
   ['c', 'rust'],
-  version: '0.10.0',
+  version: '0.10.1',
   meson_version: '>=1.3.0',
   default_options: ['warning_level=3', 'c_std=c11']
 )
@@ -36,8 +36,11 @@ is_linux = host_machine.system() == 'linux'
 cargo_pkgs = '-p ahfail-gtklock -p ahfail-pam -p ahfail-display' + (is_linux ? ' -p ahfail' : '')
 cargo_outputs = ['libahfail_module.a', 'libahfail_pam.so', 'ahfail-display'] + (is_linux ? ['ahfail'] : [])
 cargo_install_dirs = [false, get_option('libdir') / 'ahfail', get_option('libdir') / 'ahfail'] + (is_linux ? [get_option('bindir')] : [])
+# Cargo names a cdylib .dylib on macOS. The installed name stays
+# libahfail_pam.so: PAM loads the module by path, whatever the extension.
+pam_built = host_machine.system() == 'darwin' ? 'libahfail_pam.dylib' : 'libahfail_pam.so'
 cargo_copy = (' && cp "@OUTDIR@/target/release/libahfail_module.a" "@OUTPUT0@"'
-  + ' && cp "@OUTDIR@/target/release/libahfail_pam.so" "@OUTPUT1@"'
+  + ' && cp "@OUTDIR@/target/release/' + pam_built + '" "@OUTPUT1@"'
   + ' && cp "@OUTDIR@/target/release/ahfail-display" "@OUTPUT2@"'
   + (is_linux ? ' && cp "@OUTDIR@/target/release/ahfail" "@OUTPUT3@"' : ''))
 

packaging/aur-bin/PKGBUILD

@@ -0,0 +1,58 @@
+# Maintainer: Asger Geel Weirsoe <asger at weircon dot dk>
+#
+# DISCLAIMER
+#
+# ahfail is a joke with a real screen locker underneath. Two things to know
+# before installing it:
+#
+# 1. Security. It sits in the authentication path of your session. It is
+#    provided as is, without any warranty (see the AGPL-3.0 license). On
+#    Wayland a crash leaves the session locked; on X11, as with i3lock, a
+#    killed locker leaves it open. /etc/pam.d/ahfail includes `login`, so
+#    the system's pam_faillock policy applies to wrong guesses.
+#
+# 2. Media. The sprite frames and the audio clip are a parody of the
+#    "ah ah ah, you didn't say the magic word" scene from Jurassic Park
+#    (1993). The film and its characters belong to their respective rights
+#    holders; they are used here non-commercially for parody, and the
+#    AGPL-3.0 license covers the code, not those assets. Rights holders who
+#    object can reach the maintainer at the address above and the assets
+#    will be replaced.
+#
+# PROVENANCE OF THE BINARY
+#
+# Built by the gtk-ahfail release workflow from the tagged source, in an
+# archlinux:base-devel container, with --prefix=/usr and without the Gitea
+# update check. The same recipe builds the source package `ahfail`.
+#
+#   build recipe:  https://gitea.weircon.dk/agw/gtk-ahfail
+#   download:      https://asger.weirsoe.dk/tarballz/@TARBALL@
+
+pkgname=ahfail-bin
+pkgver=0.0.0
+pkgrel=1
+pkgdesc="Screen locker that says 'ah ah ah, you didn't say the magic word' on a wrong password (prebuilt binary)"
+arch=('x86_64')
+url="https://gitea.weircon.dk/agw/gtk-ahfail"
+license=('AGPL-3.0-only')
+# gst-plugins-bad-libs: libgstplayer. gst-plugins-base/-good are runtime plugins
+# (audio conversion, the mpg123 mp3 decoder) that namcap cannot see being used.
+depends=('gtk3' 'gtk-session-lock' 'gstreamer' 'gst-plugins-bad-libs' 'gst-plugins-base'
+         'gst-plugins-good' 'pam' 'glib2' 'gdk-pixbuf2' 'cairo' 'pango' 'at-spi2-core' 'gst-plugins-base-libs' 'glibc' 'libgcc' 'libx11')
+optdepends=('pipewire-pulse: raise the volume to 100% on a failed attempt (or libpulse)'
+            'libpulse: raise the volume to 100% on a failed attempt'
+            'swayidle: lock automatically on Wayland'
+            'xss-lock: lock automatically on X11'
+            'gtklock: legacy gtklock module (/usr/lib/gtklock/ahfail-module.so)')
+provides=("ahfail=$pkgver")
+conflicts=('ahfail')
+backup=('etc/pam.d/ahfail')
+install=ahfail.install
+options=('!strip' '!debug')
+source=("https://asger.weirsoe.dk/tarballz/@TARBALL@")
+sha256sums=('@SHA256@')
+
+package() {
+    # The tarball is a staged `meson install` tree: usr/ and etc/ at its root.
+    cp -a "$srcdir/usr" "$srcdir/etc" "$pkgdir/"
+}

packaging/aur-bin/ahfail.install

@@ -0,0 +1,29 @@
+_ahfail_msg() {
+    cat <<'MSG'
+==> ahfail is its own screen locker and uses its own PAM service (/etc/pam.d/ahfail).
+    Nothing in your other PAM files has been changed.
+
+    Check your setup:      ahfail doctor
+    See the effect safely: ahfail test
+    Lock the screen:       ahfail
+
+    Lock automatically:
+      Wayland: swayidle -w timeout 300 'ahfail' before-sleep 'ahfail'
+      X11:     xss-lock -- ahfail
+
+    The old PAM hook (auth optional .../libahfail_pam.so in e.g. /etc/pam.d/i3lock)
+    is no longer needed with `ahfail`. Remove that line yourself if you added it.
+MSG
+}
+
+post_install() {
+    _ahfail_msg
+}
+
+post_upgrade() {
+    # Only when coming from before 0.10.0, when ahfail became its own locker;
+    # repeating the message on every update would just teach people to skip it.
+    if (( $(vercmp "$2" 0.10.0) < 0 )); then
+        _ahfail_msg
+    fi
+}

packaging/aur/PKGBUILD

@@ -1,4 +1,4 @@
-# Maintainer: Asger Geel Weirsoe <asger@weircon.dk>
+# Maintainer: Asger Geel Weirsoe <asger at weircon dot dk>
 #
 # DISCLAIMER
 #

readme.md

@@ -81,7 +81,7 @@ Pass `--no-max-volume` to leave the volume alone.
 ### Homebrew (recommended)
 
 ```bash
-brew tap agw/ahfail https://gitea.weircon.dk/agw/homebrew-ahfail
+brew tap asger-weirsoee/tap
 brew install ahfail
 ```