README: add gearlever-bin to the package table

.github/workflows/update.yml

@@ -12,6 +12,13 @@ on:
       - '*/*'
       - '.github/workflows/update.yml'
 
+# Never run twice at once: concurrent runs race on pushing to this repository
+# and to the AUR (e.g. a push-triggered run and a manual dispatch both creating
+# a new AUR repo). Queue instead of cancelling so every trigger still lands.
+concurrency:
+  group: aur-update
+  cancel-in-progress: false
+
 permissions:
   contents: write
 

README.md

@@ -11,8 +11,9 @@ package's upstream for a new release. When one is found it:
    release of **this** repository (tag `<pkgname>-<version>`),
 3. updates the `PKGBUILD` (pkgver/pkgrel/sha256sums), test-builds it with
    `makepkg` and regenerates `.SRCINFO`,
-4. commits the changes back to this repository, and
+4. commits the changes back to this repository,
-5. pushes `PKGBUILD` + `.SRCINFO` to the AUR.
+5. pushes `PKGBUILD` + `.SRCINFO` to the AUR, and
+6. deletes the package's superseded releases (older versions, tag included).
 
 The AUR packages themselves only download the prebuilt asset from step 2, so
 users don't need any build dependencies.
@@ -23,6 +24,10 @@ users don't need any build dependencies.
 |---|---|---|
 | `timetable-bin` | [ostfriese4/untis](https://codeberg.org/ostfriese4/untis) — "Timetable", a GTK4 + LibAdwaita client for WebUntis | [timetable-bin](https://aur.archlinux.org/packages/timetable-bin) |
 | `fluxer-bin` | [fluxer.app](https://fluxer.app) — Fluxer desktop client (Electron) | [fluxer-bin](https://aur.archlinux.org/packages/fluxer-bin) |
+| `chromium-widevine-helper-bin` | [GloriousEggroll/chromium-widevine-helper](https://github.com/GloriousEggroll/chromium-widevine-helper) — extension + native helper installing Google's Widevine CDM into Chromium-based browser profiles | [chromium-widevine-helper-bin](https://aur.archlinux.org/packages/chromium-widevine-helper-bin) |
+| `sharpemu-bin` | [sharpemu/sharpemu](https://github.com/sharpemu/sharpemu) — experimental PlayStation 5 emulator | [sharpemu-bin](https://aur.archlinux.org/packages/sharpemu-bin) |
+| `thonny-bin` | [thonny/thonny](https://github.com/thonny/thonny) — Python IDE for beginners (bundles a standalone CPython + tcl/tk) | [thonny-bin](https://aur.archlinux.org/packages/thonny-bin) |
+| `gearlever-bin` | [mijorus/gearlever](https://github.com/mijorus/gearlever) — "Gear Lever", a GTK4 + LibAdwaita AppImage manager | [gearlever-bin](https://aur.archlinux.org/packages/gearlever-bin) |
 
 ## Setup (one-time)
 

chromium-widevine-helper-bin/.SRCINFO

@@ -0,0 +1,27 @@
+pkgbase = chromium-widevine-helper-bin
+	pkgdesc = Extension + native helper that installs Google's Widevine CDM into Chromium-based browser profiles (prebuilt)
+	pkgver = 1.0.8
+	pkgrel = 1
+	url = https://github.com/GloriousEggroll/chromium-widevine-helper
+	arch = any
+	license = GPL-3.0-only
+	depends = python
+	depends = procps-ng
+	depends = ca-certificates
+	provides = chromium-widevine-helper
+	conflicts = chromium-widevine-helper
+	backup = etc/helium/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/net.imput.helium/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/chromium/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/chromium-browser/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/opt/chrome/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/opt/edge/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/brave/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/vivaldi/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/opera/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/thorium/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/iridium/native-messaging-hosts/org.chromium.widevine.json
+	source = https://github.com/Felitendo/PKGBUILDS/releases/download/chromium-widevine-helper-bin-1.0.8/chromium-widevine-helper-bin-1.0.8.tar.zst
+	sha256sums = efb70f082652176710b403a2629333220c1b8b96e3f27f398ba7efb496982829
+
+pkgname = chromium-widevine-helper-bin

chromium-widevine-helper-bin/PKGBUILD

@@ -0,0 +1,31 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://github.com/Felitendo/PKGBUILDS
+
+pkgname=chromium-widevine-helper-bin
+pkgver=1.0.8
+pkgrel=1
+pkgdesc="Extension + native helper that installs Google's Widevine CDM into Chromium-based browser profiles (prebuilt)"
+arch=('any')
+url="https://github.com/GloriousEggroll/chromium-widevine-helper"
+license=('GPL-3.0-only')
+depends=('python' 'procps-ng' 'ca-certificates')
+provides=('chromium-widevine-helper')
+conflicts=('chromium-widevine-helper')
+backup=('etc/helium/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/net.imput.helium/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/chromium/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/chromium-browser/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/opt/chrome/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/opt/edge/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/brave/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/vivaldi/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/opera/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/thorium/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/iridium/native-messaging-hosts/org.chromium.widevine.json')
+source=("https://github.com/Felitendo/PKGBUILDS/releases/download/${pkgname}-${pkgver}/${pkgname}-${pkgver}.tar.zst")
+sha256sums=('efb70f082652176710b403a2629333220c1b8b96e3f27f398ba7efb496982829')
+
+package() {
+  cp -a "$srcdir/usr" "$srcdir/etc" "$pkgdir/"
+}

chromium-widevine-helper-bin/pkg.sh

@@ -0,0 +1,77 @@
+# chromium-widevine-helper-bin - prebuilt package of
+# https://github.com/GloriousEggroll/chromium-widevine-helper
+# (Chromium extension + native messaging helper that installs Google's
+# Widevine CDM into Chromium-based browser profiles).
+#
+# Upstream publishes neither releases nor tags; the canonical version lives in
+# the Fedora RPM spec on the main branch. build_artifact() snapshots main,
+# verifies the snapshot still carries the requested version and assembles the
+# install tree following upstream's spec - with Fedora's /usr/libexec
+# relocated to /usr/lib, which Arch uses instead.
+
+UPSTREAM_REPO="GloriousEggroll/chromium-widevine-helper"
+SPEC_PATH="Packaging/rpm/chromium-widevine-helper.spec"
+
+# Pure noarch install tree (Python script + JSON + extension assets).
+BUILD_DEPS=()
+
+spec_version() {
+  grep -Po '^%global helper_version \K[0-9.]+'
+}
+
+latest_version() {
+  curl -sf "https://raw.githubusercontent.com/$UPSTREAM_REPO/main/$SPEC_PATH" \
+    | spec_version
+}
+
+# build_artifact <version> <output-file>
+build_artifact() {
+  local ver="$1" outfile="$2"
+  local workdir destdir
+  workdir="$(mktemp -d)"
+  destdir="$(mktemp -d)"
+
+  curl -sfL "https://github.com/$UPSTREAM_REPO/archive/refs/heads/main.tar.gz" \
+    | tar -xz -C "$workdir" --strip-components=1
+
+  # main may have moved between the version check and this download.
+  local specver
+  specver="$(spec_version < "$workdir/$SPEC_PATH")"
+  if [[ "$specver" != "$ver" ]]; then
+    echo "snapshot of main is $specver, not the requested $ver - try again" >&2
+    return 1
+  fi
+
+  install -Dm755 "$workdir/helper/chromium-widevine" \
+    "$destdir/usr/lib/chromium-widevine/chromium-widevine"
+  install -d "$destdir/usr/bin"
+  ln -s /usr/lib/chromium-widevine/chromium-widevine "$destdir/usr/bin/chromium-widevine"
+
+  # The extension is shipped so it can be loaded unpacked from
+  # chrome://extensions (chromium-widevine --install-native-hosts then
+  # registers whatever ID the browser assigned it).
+  mkdir -p "$destdir/usr/share/chromium-widevine"
+  cp -a "$workdir/extension" "$destdir/usr/share/chromium-widevine/extension"
+  find "$destdir/usr/share/chromium-widevine" -type d -exec chmod 755 {} +
+  find "$destdir/usr/share/chromium-widevine" -type f -exec chmod 644 {} +
+
+  install -Dm644 "$workdir/README.md" \
+    "$destdir/usr/share/doc/chromium-widevine-helper-bin/README.md"
+
+  # System-wide native messaging host manifests for the same browser lookup
+  # roots upstream's RPM covers.
+  local hostdir
+  for hostdir in helium net.imput.helium chromium chromium-browser \
+                 opt/chrome opt/edge brave vivaldi opera thorium iridium; do
+    install -Dm644 "$workdir/helper/chromium-widevine-native-host.json" \
+      "$destdir/etc/$hostdir/native-messaging-hosts/org.chromium.widevine.json"
+  done
+  # The upstream manifest hardcodes Fedora's /usr/libexec helper path.
+  find "$destdir/etc" -name 'org.chromium.widevine.json' -exec \
+    sed -i 's|/usr/libexec/chromium-widevine/|/usr/lib/chromium-widevine/|' {} +
+
+  tar --zstd --sort=name --owner=0 --group=0 --numeric-owner --mtime='@0' \
+      -cf "$outfile" -C "$destdir" usr etc
+
+  rm -rf "$workdir" "$destdir"
+}

gearlever-bin/.SRCINFO

@@ -0,0 +1,31 @@
+pkgbase = gearlever-bin
+	pkgdesc = Manage AppImages with ease (prebuilt)
+	pkgver = 4.6.2
+	pkgrel = 1
+	url = https://gearlever.mijorus.it
+	arch = any
+	license = GPL-3.0-or-later
+	depends = gtk4
+	depends = libadwaita
+	depends = glib2
+	depends = dconf
+	depends = hicolor-icon-theme
+	depends = python
+	depends = python-gobject
+	depends = python-dbus
+	depends = python-requests
+	depends = python-pyxdg
+	depends = python-ftputil
+	depends = python-desktop-entry-lib
+	depends = 7zip
+	depends = binutils
+	depends = squashfs-tools
+	depends = fuse2
+	optdepends = dwarfs: extract AppImages that use a DwarFS filesystem
+	optdepends = libxml2-legacy: required by the LibreOffice AppImage
+	provides = gearlever
+	conflicts = gearlever
+	source = https://github.com/Felitendo/PKGBUILDS/releases/download/gearlever-bin-4.6.2/gearlever-bin-4.6.2.tar.zst
+	sha256sums = 319841a5dffd942b6f3b86822ac4d9d52a5b4ee559ea03ee5c2a6318a5161546
+
+pkgname = gearlever-bin

gearlever-bin/PKGBUILD

@@ -0,0 +1,25 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://github.com/Felitendo/PKGBUILDS
+
+pkgname=gearlever-bin
+pkgver=4.6.2
+pkgrel=1
+pkgdesc="Manage AppImages with ease (prebuilt)"
+arch=('any')
+url="https://gearlever.mijorus.it"
+license=('GPL-3.0-or-later')
+depends=('gtk4' 'libadwaita' 'glib2' 'dconf' 'hicolor-icon-theme' 'python'
+         'python-gobject' 'python-dbus' 'python-requests' 'python-pyxdg'
+         'python-ftputil' 'python-desktop-entry-lib'
+         '7zip' 'binutils' 'squashfs-tools' 'fuse2')
+optdepends=('dwarfs: extract AppImages that use a DwarFS filesystem'
+            'libxml2-legacy: required by the LibreOffice AppImage')
+provides=('gearlever')
+conflicts=('gearlever')
+source=("https://github.com/Felitendo/PKGBUILDS/releases/download/${pkgname}-${pkgver}/${pkgname}-${pkgver}.tar.zst")
+sha256sums=('319841a5dffd942b6f3b86822ac4d9d52a5b4ee559ea03ee5c2a6318a5161546')
+
+package() {
+  cp -a "$srcdir/usr" "$pkgdir/"
+}

gearlever-bin/pkg.sh

@@ -0,0 +1,56 @@
+# gearlever-bin - prebuilt package of https://github.com/mijorus/gearlever
+# ("Gear Lever", a GTK4 + LibAdwaita AppImage manager written in Python).
+#
+# Upstream only publishes a Flatpak bundle, so build_artifact() builds the
+# app from the release tarball and the resulting install tree is published as
+# a GitHub release asset of this repository, which the PKGBUILD then uses.
+
+UPSTREAM_REPO="mijorus/gearlever"
+
+# Installed in CI (pacman) before build_artifact runs.
+BUILD_DEPS=(meson ninja glib2 glib2-devel python gettext)
+
+latest_version() {
+  # gh instead of curl: unauthenticated GitHub API calls are rate-limited on
+  # shared CI runner IPs.
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' | sed 's/^v//'
+}
+
+# build_artifact <version> <output-file>
+build_artifact() {
+  local ver="$1" outfile="$2"
+  local workdir destdir srctree
+  workdir="$(mktemp -d)"
+  destdir="$(mktemp -d)"
+
+  curl -sfL "https://github.com/$UPSTREAM_REPO/archive/refs/tags/$ver.tar.gz" | tar -xz -C "$workdir"
+  srctree="$workdir/gearlever-$ver"
+
+  # Arch's 7zip package ships /usr/bin/7z, not the 7zz binary the Flatpak
+  # bundles, and the ELF-offset helper lives in /usr/lib/gearlever instead of
+  # somewhere on $PATH.
+  sed -i -e 's/7zz/7z/g' \
+         -e 's|get_appimage_offset|/usr/lib/gearlever/get_appimage_offset|g' \
+      "$srctree/src/providers/AppImageProvider.py"
+
+  meson setup "$workdir/build" "$srctree" --prefix=/usr --buildtype=release
+  meson install -C "$workdir/build" --destdir "$destdir"
+
+  install -Dm755 "$srctree/build-aux/get_appimage_offset.sh" \
+    "$destdir/usr/lib/gearlever/get_appimage_offset"
+
+  # src/meson.build uses install_subdir('.'), which drags the meson.build
+  # files themselves into the install tree.
+  find "$destdir" -name meson.build -delete
+
+  # These caches are generated by pacman hooks; shipping them would cause
+  # file conflicts on install.
+  rm -f "$destdir/usr/share/glib-2.0/schemas/gschemas.compiled" \
+        "$destdir/usr/share/applications/mimeinfo.cache" \
+        "$destdir/usr/share/icons/hicolor/icon-theme.cache"
+
+  tar --zstd --sort=name --owner=0 --group=0 --numeric-owner --mtime='@0' \
+      -cf "$outfile" -C "$destdir" usr
+
+  rm -rf "$workdir" "$destdir"
+}

scripts/update-package.sh

@@ -170,3 +170,22 @@ else
   git push origin HEAD:master
   echo "$pkg: pushed $ver-$rel to the AUR"
 fi
+
+### 6: prune superseded GitHub releases ######################################
+
+# Build-mode packages get one release per version; once a newer version is
+# fully published (asset built, PKGBUILD updated, AUR pushed - i.e. we got
+# this far) the older releases are no longer referenced by anything, so drop
+# them together with their tags. Runs every time to also catch leftovers.
+cd "$repo_root"
+if declare -f build_artifact >/dev/null; then
+  while IFS= read -r tag; do
+    [[ "$tag" == "$pkg-$ver" ]] && continue
+    rest="${tag#"$pkg-"}"
+    # only this package's tags: "<pkg>-<version>" (a pkgver never contains
+    # "-", which also keeps prefix-sharing package names apart)
+    [[ "$tag" == "$pkg-"* && "$rest" != *-* ]] || continue
+    echo "$pkg: deleting superseded release $tag"
+    gh release delete "$tag" --cleanup-tag --yes
+  done < <(gh release list --limit 100 --json tagName -q '.[].tagName')
+fi

sharpemu-bin/.SRCINFO

@@ -0,0 +1,27 @@
+pkgbase = sharpemu-bin
+	pkgdesc = Experimental PlayStation 5 emulator (prebuilt)
+	pkgver = 0.0.2_beta.5
+	pkgrel = 1
+	url = https://github.com/sharpemu/sharpemu
+	arch = x86_64
+	license = GPL-2.0-or-later
+	depends = glibc
+	depends = gcc-libs
+	depends = icu
+	depends = openssl
+	depends = vulkan-icd-loader
+	depends = libx11
+	depends = libxcursor
+	depends = libxi
+	depends = libxinerama
+	depends = libxrandr
+	depends = libxkbcommon
+	depends = wayland
+	provides = sharpemu
+	conflicts = sharpemu
+	noextract = sharpemu-0.0.2-beta.5-linux-x64.tar.gz
+	options = !strip
+	source_x86_64 = https://github.com/sharpemu/sharpemu/releases/download/v0.0.2-beta.5/sharpemu-0.0.2-beta.5-linux-x64.tar.gz
+	sha256sums_x86_64 = 5e75173da220832e8ca56d4b88fd7effc77772da9b785bfb721ff138d5664cc4
+
+pkgname = sharpemu-bin

sharpemu-bin/PKGBUILD

@@ -0,0 +1,39 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://github.com/Felitendo/PKGBUILDS
+
+pkgname=sharpemu-bin
+pkgver=0.0.2_beta.5
+pkgrel=1
+pkgdesc="Experimental PlayStation 5 emulator (prebuilt)"
+arch=('x86_64')
+url="https://github.com/sharpemu/sharpemu"
+license=('GPL-2.0-or-later')
+# The self-contained .NET binary bundles its own libglfw.so.3, which in turn
+# dlopens the X11/Wayland client libraries at runtime.
+depends=('glibc' 'gcc-libs' 'icu' 'openssl' 'vulkan-icd-loader'
+         'libx11' 'libxcursor' 'libxi' 'libxinerama' 'libxrandr'
+         'libxkbcommon' 'wayland')
+provides=('sharpemu')
+conflicts=('sharpemu')
+options=('!strip')
+
+# upstream tags use hyphens (v0.0.2-beta.4), which pkgver must not contain
+_upver="${pkgver//_/-}"
+noextract=("sharpemu-${_upver}-linux-x64.tar.gz")
+source_x86_64=("https://github.com/sharpemu/sharpemu/releases/download/v${_upver}/sharpemu-${_upver}-linux-x64.tar.gz")
+sha256sums_x86_64=('5e75173da220832e8ca56d4b88fd7effc77772da9b785bfb721ff138d5664cc4')
+
+package() {
+  # extracted straight into pkgdir so new files in future upstream archives
+  # are picked up automatically
+  install -d "$pkgdir/opt/$pkgname"
+  tar -xzf "$srcdir/sharpemu-${_upver}-linux-x64.tar.gz" -C "$pkgdir/opt/$pkgname"
+  chmod 755 "$pkgdir/opt/$pkgname/SharpEmu"
+
+  install -d "$pkgdir/usr/bin"
+  ln -s "/opt/$pkgname/SharpEmu" "$pkgdir/usr/bin/sharpemu"
+
+  install -Dm644 "$pkgdir/opt/$pkgname/LICENSE.txt" \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.txt"
+}

sharpemu-bin/pkg.sh

@@ -0,0 +1,28 @@
+# sharpemu-bin - SharpEmu (https://github.com/sharpemu/sharpemu), an
+# experimental PlayStation 5 emulator written in C#.
+#
+# Upstream publishes prebuilt linux-x64 release assets itself, so there is no
+# build_artifact() here: on a new version only pkgver and the checksums are
+# refreshed and the result is pushed to the AUR.
+#
+# Upstream versions contain hyphens (v0.0.2-beta.4), which an Arch pkgver
+# must not; latest_version therefore reports the underscored form
+# (0.0.2_beta.4) and the PKGBUILD derives the upstream form back via _upver.
+
+UPSTREAM_REPO="sharpemu/sharpemu"
+
+latest_version() {
+  # gh instead of plain curl: authenticated API calls, so shared-IP rate
+  # limits on the CI runners can't bite.
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' \
+    | sed -e 's/^v//' -e 's/-/_/g'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local upver="${ver//_/-}" sha
+  sha="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/v$upver/sharpemu-$upver-linux-x64.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+  sed -i "s|^sha256sums_x86_64=.*|sha256sums_x86_64=('$sha')|" "$pkgbuild"
+}

thonny-bin/.SRCINFO

@@ -0,0 +1,17 @@
+pkgbase = thonny-bin
+	pkgdesc = Python IDE for beginners (prebuilt, with bundled Python runtime)
+	pkgver = 5.0.0
+	pkgrel = 1
+	url = https://github.com/thonny/thonny
+	arch = x86_64
+	license = MIT
+	depends = glibc
+	depends = gcc-libs
+	optdepends = libnotify: desktop notifications (dlopened by Tk)
+	provides = thonny
+	conflicts = thonny
+	options = !strip
+	source = https://github.com/Felitendo/PKGBUILDS/releases/download/thonny-bin-5.0.0/thonny-bin-5.0.0.tar.zst
+	sha256sums = 7baea7ff70d7aa6e86fa1153ba8f156d8f5a402ddb5279d8e15ceceb4aaa53e5
+
+pkgname = thonny-bin

thonny-bin/PKGBUILD

@@ -0,0 +1,24 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://github.com/Felitendo/PKGBUILDS
+
+pkgname=thonny-bin
+pkgver=5.0.0
+pkgrel=1
+pkgdesc="Python IDE for beginners (prebuilt, with bundled Python runtime)"
+arch=('x86_64')
+url="https://github.com/thonny/thonny"
+license=('MIT')
+# The bundled standalone CPython (python-build-standalone) links everything
+# else - including tcl/tk 9 and its X11 client libraries - statically.
+depends=('glibc' 'gcc-libs')
+optdepends=('libnotify: desktop notifications (dlopened by Tk)')
+provides=('thonny')
+conflicts=('thonny')
+options=('!strip')
+source=("https://github.com/Felitendo/PKGBUILDS/releases/download/${pkgname}-${pkgver}/${pkgname}-${pkgver}.tar.zst")
+sha256sums=('7baea7ff70d7aa6e86fa1153ba8f156d8f5a402ddb5279d8e15ceceb4aaa53e5')
+
+package() {
+  cp -a "$srcdir/opt" "$srcdir/usr" "$pkgdir/"
+}

thonny-bin/pkg.sh

@@ -0,0 +1,102 @@
+# thonny-bin - Thonny (https://github.com/thonny/thonny), a Python IDE for
+# beginners.
+#
+# Since 5.0 upstream ships no prebuilt Linux bundle anymore - the official
+# installer script just creates a venv from the system Python and
+# pip-installs thonny plus a pinned set of extras. A venv tied to the system
+# Python would silently break on every Arch Python minor bump, so
+# build_artifact() instead bundles a relocatable standalone CPython
+# (astral-sh/python-build-standalone, tkinter included) into /opt/thonny-bin
+# and pip-installs into that, mirroring the dependency pins of upstream's
+# installer script. The install tree is published as a GitHub release asset
+# of this repository, which the PKGBUILD then uses.
+
+UPSTREAM_REPO="thonny/thonny"
+
+# Series of the bundled CPython; bump deliberately (thonny 5.x supports
+# Python 3.9-3.15).
+PYTHON_SERIES="3.13"
+
+BUILD_DEPS=()
+
+latest_version() {
+  # gh instead of plain curl: authenticated API calls, so shared-IP rate
+  # limits on the CI runners can't bite.
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' | sed 's/^v//'
+}
+
+# build_artifact <version> <output-file>
+build_artifact() {
+  local ver="$1" outfile="$2"
+  local workdir root prefix py
+  workdir="$(mktemp -d)"
+  root="$workdir/root"
+  prefix="$root/opt/thonny-bin"
+  mkdir -p "$prefix"
+
+  gh release download -R astral-sh/python-build-standalone \
+    --pattern "cpython-${PYTHON_SERIES}.*-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz" \
+    --dir "$workdir"
+  tar -xzf "$workdir"/cpython-*.tar.gz -C "$workdir"
+  cp -a "$workdir/python/." "$prefix/"
+  py="$prefix/bin/python3"
+
+  # Upstream's installer script is the authority on which extra packages
+  # (and pins) belong to a release - parse its pip install line instead of
+  # hardcoding a list that would go stale.
+  curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/v$ver/thonny-$ver.bash" \
+    -o "$workdir/installer.bash"
+  local extras=()
+  mapfile -t extras < <(grep -m1 -- "-m pip install '" "$workdir/installer.bash" \
+    | grep -oP "'[^']*'" | sed "s/^'//; s/'\$//")
+  if [[ ${#extras[@]} -eq 0 ]]; then
+    echo "thonny-bin: could not parse the extras list from the installer script" >&2
+    return 1
+  fi
+
+  "$py" -m pip install --no-cache-dir --no-compile "${extras[@]}" "thonny==$ver"
+
+  # pip wrote the staging path into the script shebangs; point them at the
+  # final install location.
+  local f
+  for f in "$prefix/bin/"*; do
+    [[ -f "$f" && ! -L "$f" && "$(head -c 2 "$f")" == '#!' ]] || continue
+    sed -i "1s|$prefix|/opt/thonny-bin|" "$f"
+  done
+
+  # Precompile with the final paths recorded in the .pyc files - users can't
+  # write __pycache__ under /opt at runtime. Some packages ship
+  # intentionally uncompilable files, hence the || true.
+  "$py" -m compileall -q -s "$root" "$prefix/lib" || true
+
+  local sitepkg
+  sitepkg="$("$py" -c 'import os, thonny; print(os.path.dirname(thonny.__file__))')"
+
+  install -d "$root/usr/bin" "$root/usr/share/applications" \
+    "$root/usr/share/pixmaps" "$root/usr/share/licenses/thonny-bin"
+  ln -s /opt/thonny-bin/bin/thonny "$root/usr/bin/thonny"
+  cp "$sitepkg/res/thonny.png" "$root/usr/share/pixmaps/thonny.png"
+  curl -sfL "https://raw.githubusercontent.com/$UPSTREAM_REPO/v$ver/LICENSE.txt" \
+    -o "$root/usr/share/licenses/thonny-bin/LICENSE.txt"
+
+  # Mirrors the launcher that upstream's installer script generates.
+  cat > "$root/usr/share/applications/thonny.desktop" <<'EOF'
+[Desktop Entry]
+Type=Application
+Name=Thonny
+GenericName=Python IDE
+Comment=Python IDE for beginners
+Exec=/opt/thonny-bin/bin/thonny %F
+Icon=thonny
+StartupWMClass=Thonny
+Terminal=false
+Categories=Development;IDE;
+Keywords=programming;education;
+MimeType=text/x-python;
+EOF
+
+  tar --zstd --sort=name --owner=0 --group=0 --numeric-owner --mtime='@0' \
+      -cf "$outfile" -C "$root" opt usr
+
+  rm -rf "$workdir"
+}