Document binary provenance in the PKGBUILD header

Checked what the AUR actually requires rather than relying on my earlier
assumption. The submission guidelines say only that packages using prebuilt
deliverables must carry the -bin suffix; nothing requires the binary to come
from upstream, so -bin is correct and sufficient here.

There is no formal 'unofficial binary' flag, so disclose it where users look:
an explicit PROVENANCE block in the PKGBUILD comment header naming the tag,
commit, build recipe and release URL, plus '(prebuilt binary)' in pkgdesc.

Corrects the README, which overstated the risk of a maintainer objecting.

README.md

@@ -128,10 +128,27 @@ Actions → Build JASP binary and publish to AUR → Run workflow
          jasp_tag = v0.98.1   force = true
 ```
 
-## Caveat worth knowing
+## Where the binary comes from, and how that is disclosed
 
-AUR convention is that a `-bin` package repackages binaries published by upstream.
+The AUR has no formal "unofficial binary" flag. What it has is the naming rule in
-Here upstream publishes no Linux binary, so this one is built by us. That is
+[AUR submission guidelines](https://wiki.archlinux.org/title/AUR_submission_guidelines#Rules_of_submission):
-unusual, and a maintainer or TU may question it. It is not against the rules, but
+
-the package description and this README should stay honest about where the binary
+> Packages that use **prebuilt** deliverables, when the sources are available,
-comes from.
+> must use the `-bin` suffix.
+
+That rule is about the deliverable being prebuilt — it says nothing about who
+built it, so `-bin` is the correct and sufficient signal here even though the
+binary is ours rather than upstream's. The two rules that could bite do not:
+JASP is not in any official repository, and the AUR repo carries only `PKGBUILD`
+and `.SRCINFO`, never the makepkg tarball or a filelist.
+
+Disclosure is therefore by convention rather than by mechanism, in the two places
+a user actually looks:
+
+- the **comment header** at the top of the `PKGBUILD` (the same header the
+  guidelines require for maintainer info) states that upstream ships no Linux
+  binary and links to the build pipeline that produced this one;
+- the **`pkgdesc`** ends in `(prebuilt binary)`.
+
+Anyone who wants to verify can read `build/build-jasp.sh` in this repo and
+reproduce the tarball.

packaging/PKGBUILD.in

@@ -1,9 +1,20 @@
 # Maintainer: @MAINTAINER@
 #
-# Upstream JASP publishes installers for Windows and macOS only. The binary this
+# PROVENANCE OF THE BINARY
-# package installs is therefore not an upstream release artifact: it is built
+#
-# from the tagged JASP sources on Arch by
+# Upstream JASP publishes installers for Windows and macOS only; the official
-# https://gitea.weircon.dk/agw/jasp-desktop-bin and published to GitHub Releases.
+# Linux channel is Flathub. The binary this package installs is therefore NOT an
+# upstream release artifact. It is compiled from the tagged JASP sources
+# (@JASP_TAG@, commit @JASP_COMMIT@) on Arch Linux by an automated
+# pipeline, and
+# published to GitHub Releases:
+#
+#   build recipe:  https://gitea.weircon.dk/agw/jasp-desktop-bin
+#   release:       @DOWNLOAD_URL@
+#
+# It bundles its own R @BUNDLED_R@ and the non-system libraries it links against
+# under /opt/jasp-desktop, so it does not constrain the versions of anything on
+# your system. Built against Qt @QT_MINOR@.
 
 pkgname=jasp-desktop-bin
 pkgver=@JASP_VERSION@

scripts/gen-pkgbuild.py

@@ -68,8 +68,11 @@ def main() -> int:
     substitutions = {
         "@MAINTAINER@": args.maintainer,
         "@JASP_VERSION@": jasp_version,
+        "@JASP_TAG@": info["jasp_tag"],
+        "@JASP_COMMIT@": info["jasp_commit"],
         "@PKGREL@": str(pkgrel),
         "@BUNDLED_R@": info["bundled_r_version"],
+        "@QT_MINOR@": qt_minor,
         "@DOWNLOAD_URL@": download_url,
         "@SHA256@": info["sha256"],
     }