The tarball host serves archives as immutable for a year, but a rebuild of
the same JASP version reused jasp-desktop-<ver>-x86_64.tar.zst with new bytes,
so a cache could hand out the old tarball against the new PKGBUILD's sha256.
The name now carries the first 12 hex digits of its sha256, and the PKGBUILD
keeps that name locally too, so a stale download in the build directory no
longer fails the checksum either.
Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
First run of the actual binary: ldd reported 'libR.so => not found'.
patchelf --set-rpath replaces the existing rpath rather than appending, so
setting it to $PREFIX/lib discarded the -Wl,-rpath the build had given the
JASP binary for the bundled R. Every other bundled library resolved; only R
went missing, because libR.so/libRblas.so/libRlapack.so live under
R/lib/R/lib rather than in the bundled lib directory. The rpath now lists
both.
Two smaller things the same run surfaced:
- makepkg ran its tidying steps on a tree that was already built and
verified - removing libtool and static library files, purging, compressing
man pages. For a -bin package that is a difference between what was tested
and what gets installed. All of them are now disabled.
- /opt/jasp-desktop/bin/JASP was not on PATH; the package now symlinks
/usr/bin/jasp.
Serve from /srv/tarballz on CT148 via a 'location /tarballz/' alias, NOT
from under /var/www/asger: the asger-web deploy swaps that whole directory
atomically, so tarballs kept inside it would be deleted on the next site
deploy. CT148's rootfs was 3G with 2.7G free - one tarball would have
filled it - so it is grown to 15G; speedy's thin pool has room even though
vgs reports the VG nearly full.
Publishing uploads to a .part name and renames on arrival so a download can
never see a truncated file, verifies sha256 on the host, then fetches the
public URL and checks it against the sha256 baked into the PKGBUILD. Both
checks run before the AUR push, so the package cannot go out pointing at a
missing file. Old tarballs are pruned to the newest three.
GH_TOKEN is kept but demoted to an optional GITHUB_PAT for R module
downloads; it no longer has anything to do with publishing.
Checked what the AUR actually requires rather than relying on my earlier
assumption. The submission guidelines say only that packages using prebuilt
deliverables must carry the -bin suffix; nothing requires the binary to come
from upstream, so -bin is correct and sufficient here.
There is no formal 'unofficial binary' flag, so disclose it where users look:
an explicit PROVENANCE block in the PKGBUILD comment header naming the tag,
commit, build recipe and release URL, plus '(prebuilt binary)' in pkgdesc.
Corrects the README, which overstated the risk of a maintainer objecting.
Bundling R alone was not enough: R links libicuuc, and Arch moves ICU
regularly. The obvious fix - pinning 'icu>=78 <79' in depends - is worse
than the disease on a rolling distro, because pacman would then refuse to
upgrade ICU while JASP is installed, blocking the user's whole system
upgrade until a rebuild lands.
So bundle-libs.sh copies every non-system shared library into
/opt/jasp-desktop/lib and rewrites rpaths, by denylist rather than
allowlist. depends now carries no version constraints at all.
Qt6 stays system-provided on purpose - Qt is binary compatible across Qt 6
minors, and bundling QtWebEngine would add ~500 MB. That also means the
only rebuild triggers left are a new JASP release and a Qt major bump;
rebuilding for anything else would cost users a 1.7 GB re-download.
Also fixes check-upstream.py querying only repo=Extra, which silently
returned nothing for icu (it lives in core).
Arch ships R 4.6.1, but JASP pins its R packages against a frozen CRAN
snapshot (2026-03-31 for 0.98.1) that targets R 4.5. Configuring against
Arch's R fails at Rcpp 1.1.1, which cannot compile on R 4.6 since
R_NamespaceRegistry was removed; the Rcpp release that fixes it is newer
than the pinned snapshot, so the lockfile cannot reach it either.
Build R 4.5.3 into /opt/jasp-desktop/R and point R_HOME at it, matching
what upstream CI does. This drops 'r' from depends entirely, so an Arch R
upgrade can no longer break an installed JASP, and the rebuild triggers
become Qt6 and ICU - the libraries actually still linked against.
Upstream JASP ships no Linux binary, so the existing AUR package builds
everything from source including several hundred R packages. This builds
that once in CI and publishes the result as jasp-desktop-bin.
JASP links against the system R and Qt6 rather than bundling them, so a
rebuild is triggered by an Arch r/qt6-base bump as well as by a new JASP
release, and the generated PKGBUILD pins depends to the versions actually
built against.
agw