Link the project page from the readme

The page on asger.weirsøe.dk tells the story behind ahfail and links back here.

Claude-Session: https://claude.ai/code/session_012LCTmU2ewo8tnM1dByYAoG

.gitea/workflows/aur-publish.yml

@@ -116,7 +116,7 @@ jobs:
           printf '%s\n' "$TARBALLZ_SSH_KEY" > ~/.ssh/tarballz
           chmod 600 ~/.ssh/tarballz
           ssh -i ~/.ssh/tarballz -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            root@192.168.10.148 < aur-pkg/PKGBUILD
+            "${{ secrets.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD
 
   # ahfail-bin: the same release, prebuilt. The binary is built from the TAG
   # (also when this runs by hand from master), staged as a `meson install` tree,
@@ -186,7 +186,7 @@ jobs:
           # Forced command on the web host: this key may only write ahfail-*.tar.*
           # and ahfail-bin.PKGBUILD, and keeps the newest three tarballs.
           ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            root@192.168.10.148 "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}"
+            "${{ secrets.TARBALLZ_TARGET }}" "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}"
 
       - name: Verify the public URL serves the same bytes
         run: |
@@ -244,4 +244,4 @@ jobs:
         continue-on-error: true
         run: |
           ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            root@192.168.10.148 < aur-bin-pkg/PKGBUILD
+            "${{ secrets.TARBALLZ_TARGET }}" < aur-bin-pkg/PKGBUILD

Cargo.lock

@@ -10,7 +10,7 @@ checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "ahfail"
-version = "0.10.1"
+version = "0.10.2"
 dependencies = [
  "ahfail-ui",
  "cc",

crates/ahfail/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ahfail"
-version = "0.10.1"
+version = "0.10.2"
 edition = "2021"
 description = "Screen locker that says ah ah ah when you get the password wrong"
 license = "AGPL-3.0-only"

meson.build

@@ -1,7 +1,7 @@
 project(
   'ahfail',
   ['c', 'rust'],
-  version: '0.10.1',
+  version: '0.10.2',
   meson_version: '>=1.3.0',
   default_options: ['warning_level=3', 'c_std=c11']
 )
@@ -9,17 +9,7 @@ project(
 ahfail_inc = include_directories('include')
 
 cc = meson.get_compiler('c')
-m_dep = cc.find_library('m', required : false)
+is_linux = host_machine.system() == 'linux'
-gtk_dep = dependency('gtk+-3.0')
-gstplayer_dep = dependency('gstreamer-player-1.0')
-gnome = import('gnome')
-
-resources = gnome.compile_resources(
-  'ahfail-resources',
-  'assets/ahfail.gresource.xml',
-  source_dir: 'assets',
-  c_name: 'ahfail'
-)
 
 # All Rust artefacts come from ONE cargo invocation with one target directory.
 # Four separate builds with four target directories compiled the whole GTK and
@@ -30,19 +20,29 @@ resources = gnome.compile_resources(
 # client is not compiled in at all.
 cargo_features = get_option('update_check') ? '' : '--no-default-features'
 
-# The ahfail command is the Linux locker (Wayland/X11 + its own PAM service).
+# Linux builds everything: the ahfail locker, the gtklock module (Wayland), the
-# macOS keeps the PAM hook and is built without it until it has been tested there.
+# PAM hook and its display binary. macOS only has the PAM hook + display binary:
-is_linux = host_machine.system() == 'linux'
+# gtklock and the locker are Linux-only, and the module's GNU-ld link flags do
-cargo_pkgs = '-p ahfail-gtklock -p ahfail-pam -p ahfail-display' + (is_linux ? ' -p ahfail' : '')
+# not exist on macOS.
-cargo_outputs = ['libahfail_module.a', 'libahfail_pam.so', 'ahfail-display'] + (is_linux ? ['ahfail'] : [])
-cargo_install_dirs = [false, get_option('libdir') / 'ahfail', get_option('libdir') / 'ahfail'] + (is_linux ? [get_option('bindir')] : [])
 # Cargo names a cdylib .dylib on macOS. The installed name stays
 # libahfail_pam.so: PAM loads the module by path, whatever the extension.
 pam_built = host_machine.system() == 'darwin' ? 'libahfail_pam.dylib' : 'libahfail_pam.so'
-cargo_copy = (' && cp "@OUTDIR@/target/release/libahfail_module.a" "@OUTPUT0@"'
+if is_linux
-  + ' && cp "@OUTDIR@/target/release/' + pam_built + '" "@OUTPUT1@"'
+  cargo_pkgs = '-p ahfail-gtklock -p ahfail-pam -p ahfail-display -p ahfail'
-  + ' && cp "@OUTDIR@/target/release/ahfail-display" "@OUTPUT2@"'
+  cargo_outputs = ['libahfail_module.a', 'libahfail_pam.so', 'ahfail-display', 'ahfail']
-  + (is_linux ? ' && cp "@OUTDIR@/target/release/ahfail" "@OUTPUT3@"' : ''))
+  # module archive: linked below, not installed; PAM hook + display: libdir/ahfail; locker: bindir.
+  cargo_install_dirs = [false, get_option('libdir') / 'ahfail', get_option('libdir') / 'ahfail', get_option('bindir')]
+  cargo_copy = (' && cp "@OUTDIR@/target/release/libahfail_module.a" "@OUTPUT0@"'
+    + ' && cp "@OUTDIR@/target/release/libahfail_pam.so" "@OUTPUT1@"'
+    + ' && cp "@OUTDIR@/target/release/ahfail-display" "@OUTPUT2@"'
+    + ' && cp "@OUTDIR@/target/release/ahfail" "@OUTPUT3@"')
+else
+  cargo_pkgs = '-p ahfail-pam -p ahfail-display'
+  cargo_outputs = ['libahfail_pam.so', 'ahfail-display']
+  cargo_install_dirs = [get_option('libdir') / 'ahfail', get_option('libdir') / 'ahfail']
+  cargo_copy = (' && cp "@OUTDIR@/target/release/' + pam_built + '" "@OUTPUT0@"'
+    + ' && cp "@OUTDIR@/target/release/ahfail-display" "@OUTPUT1@"')
+endif
 
 cargo_all = custom_target(
   'ahfail-cargo-build',
@@ -61,13 +61,10 @@ cargo_all = custom_target(
   build_by_default: true,
   build_always_stale: true,  # cargo decides what is out of date, not meson
   install: true,
-  # module archive: linked below, not installed; PAM module + display binary:
-  # libdir/ahfail; the ahfail command: bindir.
   install_dir: cargo_install_dirs,
   install_mode: 'rwxr-xr-x'
 )
-cargo_target = cargo_all[0]
+pam_cargo = is_linux ? cargo_all[1] : cargo_all[0]
-pam_cargo = cargo_all[1]
 
 # The locker's own PAM service. Shipped as its own file, like swaylock and
 # gtklock do, so no other package's PAM configuration is ever touched.
@@ -78,33 +75,46 @@ if is_linux
   )
 endif
 
-libahfail = shared_library(
+if is_linux
-  'ahfail-module',
+  m_dep = cc.find_library('m', required : false)
-  resources,
+  gtk_dep = dependency('gtk+-3.0')
-  link_args: ['-Wl,--whole-archive', meson.current_build_dir() / 'libahfail_module.a', '-Wl,--no-whole-archive'],
+  gstplayer_dep = dependency('gstreamer-player-1.0')
-  link_depends: cargo_target,
+  resources = import('gnome').compile_resources(
-  include_directories: ahfail_inc,
+    'ahfail-resources',
-  dependencies: [gtk_dep, gstplayer_dep, m_dep],
+    'assets/ahfail.gresource.xml',
-  install: true,
+    source_dir: 'assets',
-  install_dir: get_option('libdir') / 'gtklock',
+    c_name: 'ahfail'
-  name_prefix: ''
+  )
-)
 
-smoke = executable(
+  # The gtklock module (Wayland): the Rust staticlib linked whole into a .so.
-  'module_smoke_test',
+  libahfail = shared_library(
-  'tests/module_test.c',
+    'ahfail-module',
-  include_directories: ahfail_inc,
+    resources,
-  link_with: libahfail,
+    link_args: ['-Wl,--whole-archive', meson.current_build_dir() / 'libahfail_module.a', '-Wl,--no-whole-archive'],
-  dependencies: [gtk_dep, gstplayer_dep]
+    link_depends: cargo_all[0],
-)
+    include_directories: ahfail_inc,
+    dependencies: [gtk_dep, gstplayer_dep, m_dep],
+    install: true,
+    install_dir: get_option('libdir') / 'gtklock',
+    name_prefix: ''
+  )
 
-test('module symbols', smoke)
+  smoke = executable(
+    'module_smoke_test',
+    'tests/module_test.c',
+    include_directories: ahfail_inc,
+    link_with: libahfail,
+    dependencies: [gtk_dep, gstplayer_dep]
+  )
+
+  test('module symbols', smoke)
+endif
 
 # PAM module smoke test: dlopen libahfail_pam.so and verify pam_sm_authenticate is exported.
 pam_smoke = executable(
   'pam_smoke_test',
   'tests/pam_smoke_test.c',
-  dependencies: [cc.find_library('dl', required: true)]
+  dependencies: [cc.find_library('dl', required: false)]  # part of libSystem on macOS
 )
 
 test('pam symbols', pam_smoke,

packaging/aur-bin/PKGBUILD

@@ -33,7 +33,7 @@ pkgver=0.0.0
 pkgrel=1
 pkgdesc="Screen locker that says 'ah ah ah, you didn't say the magic word' on a wrong password (prebuilt binary)"
 arch=('x86_64')
-url="https://gitea.weircon.dk/agw/gtk-ahfail"
+url="https://asger.weirsøe.dk/en/projects/ahfail"
 license=('AGPL-3.0-only')
 # gst-plugins-bad-libs: libgstplayer. gst-plugins-base/-good are runtime plugins
 # (audio conversion, the mpg123 mp3 decoder) that namcap cannot see being used.

packaging/aur/PKGBUILD

@@ -1,4 +1,5 @@
 # Maintainer: Asger Geel Weirsoe <asger at weircon dot dk>
+#   build recipe:  https://gitea.weircon.dk/agw/gtk-ahfail
 #
 # DISCLAIMER
 #
@@ -23,7 +24,8 @@ pkgver=0.0.0
 pkgrel=1
 pkgdesc="Screen locker that says 'ah ah ah, you didn't say the magic word' on a wrong password"
 arch=('x86_64')
-url="https://gitea.weircon.dk/agw/gtk-ahfail"
+url="https://asger.weirsøe.dk/en/projects/ahfail"
+_repo="https://gitea.weircon.dk/agw/gtk-ahfail"
 license=('AGPL-3.0-only')
 # gst-plugins-bad-libs: libgstplayer. gst-plugins-base/-good are runtime plugins
 # (audio conversion, the mpg123 mp3 decoder) that namcap cannot see being used.
@@ -38,7 +40,7 @@ optdepends=('pipewire-pulse: raise the volume to 100% on a failed attempt (or li
 backup=('etc/pam.d/ahfail')
 install=ahfail.install
 options=('!lto')
-source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
+source=("$pkgname-$pkgver.tar.gz::$_repo/archive/v$pkgver.tar.gz")
 sha256sums=('SKIP')
 
 prepare() {

readme.md

@@ -10,6 +10,8 @@ ahfail doctor   # check this machine and explain what is missing
 
 One command on Linux: `ahfail` works out whether you run Wayland or X11 and does the right thing. On macOS the effect comes from a PAM hook on the system lock screen (see below).
 
+Project page, with the story behind it: [asger.weirsøe.dk/en/projects/ahfail](https://asger.xn--weirse-fya.dk/en/projects/ahfail)
+
 ---
 
 > **Security disclaimer**