From f0f317ca2f1f025242e1818a81055fa753a45211 Mon Sep 17 00:00:00 2001
From: agw <cla@weircon.dk>
Date: Tue, 1 Sep 2026 22:30:00 +0200
Subject: [PATCH] Document binary provenance in the PKGBUILD header

Checked what the AUR actually requires rather than relying on my earlier
assumption. The submission guidelines say only that packages using prebuilt
deliverables must carry the -bin suffix; nothing requires the binary to come
from upstream, so -bin is correct and sufficient here.

There is no formal 'unofficial binary' flag, so disclose it where users look:
an explicit PROVENANCE block in the PKGBUILD comment header naming the tag,
commit, build recipe and release URL, plus '(prebuilt binary)' in pkgdesc.

Corrects the README, which overstated the risk of a maintainer objecting.
---
 README.md               | 29 +++++++++++++++++++++++------
 packaging/PKGBUILD.in   | 19 +++++++++++++++----
 scripts/gen-pkgbuild.py |  3 +++
 3 files changed, 41 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index 6cc2cd9..ec999ef 100644
--- a/README.md
+++ b/README.md
@@ -128,10 +128,27 @@ Actions → Build JASP binary and publish to AUR → Run workflow
          jasp_tag = v0.98.1   force = true
 ```
 
-## Caveat worth knowing
+## Where the binary comes from, and how that is disclosed
 
-AUR convention is that a `-bin` package repackages binaries published by upstream.
-Here upstream publishes no Linux binary, so this one is built by us. That is
-unusual, and a maintainer or TU may question it. It is not against the rules, but
-the package description and this README should stay honest about where the binary
-comes from.
+The AUR has no formal "unofficial binary" flag. What it has is the naming rule in
+[AUR submission guidelines](https://wiki.archlinux.org/title/AUR_submission_guidelines#Rules_of_submission):
+
+> Packages that use **prebuilt** deliverables, when the sources are available,
+> must use the `-bin` suffix.
+
+That rule is about the deliverable being prebuilt — it says nothing about who
+built it, so `-bin` is the correct and sufficient signal here even though the
+binary is ours rather than upstream's. The two rules that could bite do not:
+JASP is not in any official repository, and the AUR repo carries only `PKGBUILD`
+and `.SRCINFO`, never the makepkg tarball or a filelist.
+
+Disclosure is therefore by convention rather than by mechanism, in the two places
+a user actually looks:
+
+- the **comment header** at the top of the `PKGBUILD` (the same header the
+  guidelines require for maintainer info) states that upstream ships no Linux
+  binary and links to the build pipeline that produced this one;
+- the **`pkgdesc`** ends in `(prebuilt binary)`.
+
+Anyone who wants to verify can read `build/build-jasp.sh` in this repo and
+reproduce the tarball.
diff --git a/packaging/PKGBUILD.in b/packaging/PKGBUILD.in
index 2f86b4b..a6852ce 100644
--- a/packaging/PKGBUILD.in
+++ b/packaging/PKGBUILD.in
@@ -1,9 +1,20 @@
 # Maintainer: @MAINTAINER@
 #
-# Upstream JASP publishes installers for Windows and macOS only. The binary this
-# package installs is therefore not an upstream release artifact: it is built
-# from the tagged JASP sources on Arch by
-# https://gitea.weircon.dk/agw/jasp-desktop-bin and published to GitHub Releases.
+# PROVENANCE OF THE BINARY
+#
+# Upstream JASP publishes installers for Windows and macOS only; the official
+# Linux channel is Flathub. The binary this package installs is therefore NOT an
+# upstream release artifact. It is compiled from the tagged JASP sources
+# (@JASP_TAG@, commit @JASP_COMMIT@) on Arch Linux by an automated
+# pipeline, and
+# published to GitHub Releases:
+#
+#   build recipe:  https://gitea.weircon.dk/agw/jasp-desktop-bin
+#   release:       @DOWNLOAD_URL@
+#
+# It bundles its own R @BUNDLED_R@ and the non-system libraries it links against
+# under /opt/jasp-desktop, so it does not constrain the versions of anything on
+# your system. Built against Qt @QT_MINOR@.
 
 pkgname=jasp-desktop-bin
 pkgver=@JASP_VERSION@
diff --git a/scripts/gen-pkgbuild.py b/scripts/gen-pkgbuild.py
index 98786fe..255ad52 100755
--- a/scripts/gen-pkgbuild.py
+++ b/scripts/gen-pkgbuild.py
@@ -68,8 +68,11 @@ def main() -> int:
     substitutions = {
         "@MAINTAINER@": args.maintainer,
         "@JASP_VERSION@": jasp_version,
+        "@JASP_TAG@": info["jasp_tag"],
+        "@JASP_COMMIT@": info["jasp_commit"],
         "@PKGREL@": str(pkgrel),
         "@BUNDLED_R@": info["bundled_r_version"],
+        "@QT_MINOR@": qt_minor,
         "@DOWNLOAD_URL@": download_url,
         "@SHA256@": info["sha256"],
     }