5 Commits

Include renames

Author	SHA1	Message	Date
agw	f3a6822744	Self-host tarballs on asger.weirsoe.dk instead of GitHub Releases ... Serve from /srv/tarballz on CT148 via a 'location /tarballz/' alias, NOT from under /var/www/asger: the asger-web deploy swaps that whole directory atomically, so tarballs kept inside it would be deleted on the next site deploy. CT148's rootfs was 3G with 2.7G free - one tarball would have filled it - so it is grown to 15G; speedy's thin pool has room even though vgs reports the VG nearly full. Publishing uploads to a .part name and renames on arrival so a download can never see a truncated file, verifies sha256 on the host, then fetches the public URL and checks it against the sha256 baked into the PKGBUILD. Both checks run before the AUR push, so the package cannot go out pointing at a missing file. Old tarballs are pruned to the newest three. GH_TOKEN is kept but demoted to an optional GITHUB_PAT for R module downloads; it no longer has anything to do with publishing.	2026-09-01 22:50:00 +02:00
agw	f0f317ca2f	Document binary provenance in the PKGBUILD header ... Checked what the AUR actually requires rather than relying on my earlier assumption. The submission guidelines say only that packages using prebuilt deliverables must carry the -bin suffix; nothing requires the binary to come from upstream, so -bin is correct and sufficient here. There is no formal 'unofficial binary' flag, so disclose it where users look: an explicit PROVENANCE block in the PKGBUILD comment header naming the tag, commit, build recipe and release URL, plus '(prebuilt binary)' in pkgdesc. Corrects the README, which overstated the risk of a maintainer objecting.	2026-09-01 22:30:00 +02:00
agw	56434ba7ed	Bundle non-system libraries instead of version-pinning depends ... Bundling R alone was not enough: R links libicuuc, and Arch moves ICU regularly. The obvious fix - pinning 'icu>=78 <79' in depends - is worse than the disease on a rolling distro, because pacman would then refuse to upgrade ICU while JASP is installed, blocking the user's whole system upgrade until a rebuild lands. So bundle-libs.sh copies every non-system shared library into /opt/jasp-desktop/lib and rewrites rpaths, by denylist rather than allowlist. depends now carries no version constraints at all. Qt6 stays system-provided on purpose - Qt is binary compatible across Qt 6 minors, and bundling QtWebEngine would add ~500 MB. That also means the only rebuild triggers left are a new JASP release and a Qt major bump; rebuilding for anything else would cost users a 1.7 GB re-download. Also fixes check-upstream.py querying only repo=Extra, which silently returned nothing for icu (it lives in core).	2026-09-01 22:05:00 +02:00
agw	d880e6748c	Bundle our own R 4.5.3 instead of building against Arch's R ... Arch ships R 4.6.1, but JASP pins its R packages against a frozen CRAN snapshot (2026-03-31 for 0.98.1) that targets R 4.5. Configuring against Arch's R fails at Rcpp 1.1.1, which cannot compile on R 4.6 since R_NamespaceRegistry was removed; the Rcpp release that fixes it is newer than the pinned snapshot, so the lockfile cannot reach it either. Build R 4.5.3 into /opt/jasp-desktop/R and point R_HOME at it, matching what upstream CI does. This drops 'r' from depends entirely, so an Arch R upgrade can no longer break an installed JASP, and the rebuild triggers become Qt6 and ICU - the libraries actually still linked against.	2026-09-01 21:40:00 +02:00
agw	0d4db32d5c	Automated Arch binary builds of JASP for the AUR ... Upstream JASP ships no Linux binary, so the existing AUR package builds everything from source including several hundred R packages. This builds that once in CI and publishes the result as jasp-desktop-bin. JASP links against the system R and Qt6 rather than bundling them, so a rebuild is triggered by an Arch r/qt6-base bump as well as by a new JASP release, and the generated PKGBUILD pins depends to the versions actually built against.	2026-09-01 20:30:00 +02:00