From 3382a42b993d571c787a566dead649f3d33107a0 Mon Sep 17 00:00:00 2001
From: Bendik Aagaard Lynghaug <bendik.lynghaug@gmail.com>
Date: Sat, 3 Oct 2026 12:43:46 +0200
Subject: [PATCH] varde in the uhhm Arch registry

dist/arch/PKGBUILD packages the release tarballs: system and per-user
units, the per-user socket on for every session (as PipeWire's is; the
daemon starts only when an app connects), config and man pages. The
release workflow publishes it for x86_64 and aarch64 from klokka.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .gitea/workflows/release.yml | 42 ++++++++++++++++++++++++++++++++++++
 dist/arch/PKGBUILD           | 41 +++++++++++++++++++++++++++++++++++
 dist/arch/varde.install      | 10 +++++++++
 3 files changed, 93 insertions(+)
 create mode 100644 dist/arch/PKGBUILD
 create mode 100644 dist/arch/varde.install

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index b215dca..aa850d8 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -89,3 +89,45 @@ jobs:
               -H "Authorization: token $TOKEN" \
               -F "attachment=@$f"
           done
+
+  # The uhhm Arch registry (pacman.conf: .../api/packages/bl/arch/uhhm),
+  # from the tarballs just released. On klokka: an Arch host with
+  # makepkg. REGISTRY_TOKEN is the uhhm org's write:package token.
+  publish:
+    needs: build
+    runs-on: aarch64
+    steps:
+      - name: checkout
+        uses: builtin:checkout
+      - name: fetch tarballs and pin the PKGBUILD
+        run: |
+          set -eu
+          TAG="${GITHUB_REF_NAME}"
+          VERSION="${TAG#v}"
+          BASE="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/download/${TAG}"
+          cd dist/arch
+          for t in x86_64 aarch64; do
+            f="varde-${VERSION}-${t}-unknown-linux-gnu.tar.gz"
+            # The repo is private: anonymous release downloads 404.
+            curl -fsSL -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -o "$f" "$BASE/$f"
+          done
+          SUM_X86=$(sha256sum "varde-${VERSION}-x86_64-unknown-linux-gnu.tar.gz" | cut -d' ' -f1)
+          SUM_AARCH=$(sha256sum "varde-${VERSION}-aarch64-unknown-linux-gnu.tar.gz" | cut -d' ' -f1)
+          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" PKGBUILD
+          sed -i "s/sha256sums_x86_64=('.*')/sha256sums_x86_64=('${SUM_X86}')/" PKGBUILD
+          sed -i "s/sha256sums_aarch64=('.*')/sha256sums_aarch64=('${SUM_AARCH}')/" PKGBUILD
+      - name: publish to the uhhm Arch registry
+        run: |
+          set -eu
+          if [ -z "${{ secrets.REGISTRY_TOKEN }}" ]; then
+            echo "::error::REGISTRY_TOKEN not set - add it to publish"
+            exit 1
+          fi
+          cd dist/arch
+          for carch in aarch64 x86_64; do
+            pkgfile=$(CARCH="$carch" makepkg --packagelist | tail -1)
+            CARCH="$carch" makepkg -f --nodeps --noconfirm
+            curl --fail-with-body --user "bl:${{ secrets.REGISTRY_TOKEN }}" \
+              --upload-file "$pkgfile" \
+              "${GITHUB_SERVER_URL}/api/packages/bl/arch/uhhm"
+          done
diff --git a/dist/arch/PKGBUILD b/dist/arch/PKGBUILD
new file mode 100644
index 0000000..9f6f8c6
--- /dev/null
+++ b/dist/arch/PKGBUILD
@@ -0,0 +1,41 @@
+# The uhhm Arch registry package, built by .gitea/workflows/release.yml
+# from the release tarballs (the CI pins pkgver and the sums). For a
+# from-source build (AUR style) see ../PKGBUILD.
+pkgname=varde
+pkgver=0.1.3
+pkgrel=1
+pkgdesc="Content-addressed blob mirror daemon on iroh"
+arch=('x86_64' 'aarch64')
+url="https://project.uhhm.no/uhhm/varde"
+license=('MIT OR Apache-2.0')
+depends=('gcc-libs' 'glibc')
+optdepends=('networkmanager: metered-connection detection')
+backup=('etc/varde/config.toml')
+install=varde.install
+options=('!strip' '!debug')
+source_x86_64=("varde-${pkgver}-x86_64-unknown-linux-gnu.tar.gz")
+source_aarch64=("varde-${pkgver}-aarch64-unknown-linux-gnu.tar.gz")
+sha256sums_x86_64=('SKIP')
+sha256sums_aarch64=('SKIP')
+
+package() {
+  cd "varde-${pkgver}-${CARCH}-unknown-linux-gnu"
+  install -Dm755 bin/varde-daemon "$pkgdir/usr/bin/varde-daemon"
+  install -Dm755 bin/varde-ctl "$pkgdir/usr/bin/varde-ctl"
+
+  install -Dm644 systemd/varde.service "$pkgdir/usr/lib/systemd/system/varde.service"
+  install -Dm644 systemd/varde.socket "$pkgdir/usr/lib/systemd/system/varde.socket"
+  install -Dm644 systemd/user/varde.service "$pkgdir/usr/lib/systemd/user/varde.service"
+  install -Dm644 systemd/user/varde.socket "$pkgdir/usr/lib/systemd/user/varde.socket"
+  # The per-user socket is on for every session, the way PipeWire's
+  # is: it costs nothing until an app connects, and then the daemon
+  # starts by socket activation. The system daemon stays opt-in.
+  install -dm755 "$pkgdir/usr/lib/systemd/user/sockets.target.wants"
+  ln -s ../varde.socket "$pkgdir/usr/lib/systemd/user/sockets.target.wants/varde.socket"
+
+  install -Dm644 config.toml.example "$pkgdir/etc/varde/config.toml"
+  install -Dm644 man/varde.8 "$pkgdir/usr/share/man/man8/varde.8"
+  install -Dm644 man/varde-ctl.1 "$pkgdir/usr/share/man/man1/varde-ctl.1"
+  install -Dm644 LICENSE-MIT "$pkgdir/usr/share/licenses/$pkgname/LICENSE-MIT"
+  install -Dm644 LICENSE-APACHE "$pkgdir/usr/share/licenses/$pkgname/LICENSE-APACHE"
+}
diff --git a/dist/arch/varde.install b/dist/arch/varde.install
new file mode 100644
index 0000000..c19e7c8
--- /dev/null
+++ b/dist/arch/varde.install
@@ -0,0 +1,10 @@
+post_install() {
+  echo ":: The per-user varde socket starts with your next login."
+  echo "   To use it now: systemctl --user daemon-reload && systemctl --user start varde.socket"
+  echo "   The system daemon is opt-in: systemctl enable --now varde.socket"
+}
+
+post_upgrade() {
+  echo ":: Restart a running daemon to pick up the new version:"
+  echo "   systemctl --user try-restart varde.service   (and/or: systemctl try-restart varde.service)"
+}