kitty-tune-bin: update to 1.4.1-1 [skip ci]

The release tags now point at the squashed history, so GitHub's tarballs changed.

.github/workflows/notify.yml

@@ -0,0 +1,163 @@
+name: Notify
+
+# Opens an issue when a package fails to update on main, so it shows up in the
+# notifications on git.felo.gg. One issue per package: a broken package must
+# not hide behind another one, and a run of only some packages must not close
+# the issues of the others. A later failure refreshes the issue instead of
+# commenting, as the schedule would otherwise add one every 6 hours. The next
+# successful update of that package closes it again.
+#
+# Talks to the Gitea API with curl: gh only knows GitHub.
+
+on:
+  workflow_run:
+    workflows: [Update AUR packages]
+    types: [completed]
+
+permissions:
+  actions: read
+  issues: write
+
+concurrency:
+  group: notify
+  cancel-in-progress: false
+
+jobs:
+  notify:
+    name: Notify
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.workflow_run.event != 'pull_request' &&
+      github.event.workflow_run.head_branch == github.event.repository.default_branch
+    steps:
+      - name: Open, update or close the failure issues
+        env:
+          TOKEN: ${{ github.token }}
+          API: ${{ github.api_url }}/repos/${{ github.repository }}
+          OWNER: ${{ github.repository_owner }}
+          WORKFLOW: ${{ github.event.workflow_run.name || 'Update AUR packages' }}
+          CONCLUSION: ${{ github.event.workflow_run.conclusion }}
+          EVENT: ${{ github.event.workflow_run.event }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+          RUN_URL: ${{ github.event.workflow_run.html_url }}
+          SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          set -euo pipefail
+          label=ci-failure
+
+          api() {
+            local method=$1 path=$2
+            shift 2
+            curl -fsSL -X "$method" -H "Authorization: token $TOKEN" \
+              -H 'Content-Type: application/json' "$API$path" "$@"
+          }
+
+          issues="$(api GET "/issues?state=open&type=issues&labels=$label&limit=50")"
+
+          label_id() {
+            local id
+            id="$(api GET '/labels?limit=50' | jq -r --arg l "$label" '.[] | select(.name == $l) | .id')"
+            if [ -z "$id" ]; then
+              id="$(api POST /labels -d "$(jq -cn --arg l "$label" \
+                '{name: $l, color: "#d73a4a", description: "A package fails to update"}')" | jq -r .id)"
+            fi
+            echo "$id"
+          }
+
+          # The issue title for a job: the package for "update (<package>)",
+          # the workflow for anything else.
+          title_for() {
+            if [[ $1 =~ ^update\ \((.+)\)$ ]]; then
+              echo "${BASH_REMATCH[1]} fails to update"
+            else
+              echo "$WORKFLOW is failing"
+            fi
+          }
+
+          issue_for() {
+            jq -r --arg title "$1" '.[] | select(.title == $title) | .number' <<<"$issues" | head -1
+          }
+
+          # The lines of the failed step leading up to its first error, enough
+          # to see what broke without opening the log. Falls back to the end
+          # of the log.
+          excerpt_for() {
+            local log
+            log="$(api GET "/actions/jobs/$1/logs" |
+              sed -E 's/^[0-9TZ:.-]+ //; s/\x1b\[[0-9;]*m//g')" || return 0
+            awk '/^(##\[group\]|::group::)Run / { out = "" } { out = out $0 "\n" }
+              /^(##\[error\]|::error::)/ { printf "%s", out; found = 1; exit }
+              END { if (!found) exit 1 }' <<<"$log" | tail -40 ||
+              tail -40 <<<"$log"
+          }
+
+          # report <title> <job json, or empty if the run never started>
+          report() {
+            local title=$1 job=$2 line excerpt="" issue body
+            if [ -n "$job" ]; then
+              line="$(jq -r '"- [\(.name)](\(.html_url))" +
+                ([.steps[]? | select(.conclusion == "failure") | .name] |
+                  if length > 0 then ": " + join(", ") else "" end)' <<<"$job")"
+              excerpt="$(excerpt_for "$(jq -r .id <<<"$job")")"
+            else
+              line="The run did not start ($CONCLUSION)."
+            fi
+
+            body="$(cat <<EOF
+          [$WORKFLOW]($RUN_URL) failed on \`${SHA:0:7}\`, started by \`$EVENT\`.
+
+          $line
+          EOF
+            )"
+            if [ -n "$excerpt" ]; then
+              body="$body
+
+          <details>
+          <summary>Log</summary>
+
+          \`\`\`
+          $excerpt
+          \`\`\`
+
+          </details>"
+            fi
+
+            issue="$(issue_for "$title")"
+            if [ -n "$issue" ]; then
+              api PATCH "/issues/$issue" -d "$(jq -cn --arg b "$body" '{body: $b}')" >/dev/null
+            else
+              api POST /issues -d "$(jq -cn --arg t "$title" --arg b "@$OWNER $body" \
+                --argjson l "$(label_id)" '{title: $t, body: $b, labels: [$l]}')" >/dev/null
+            fi
+          }
+
+          close() {
+            local issue
+            issue="$(issue_for "$1")"
+            if [ -n "$issue" ]; then
+              api POST "/issues/$issue/comments" \
+                -d "$(jq -cn --arg b "Passing again: $RUN_URL" '{body: $b}')" >/dev/null
+              api PATCH "/issues/$issue" -d '{"state": "closed"}' >/dev/null
+            fi
+          }
+
+          if [ "$CONCLUSION" = startup_failure ]; then
+            report "$WORKFLOW is failing" ""
+            exit 0
+          fi
+
+          # Cancelled and skipped jobs say nothing about a package.
+          page=1
+          while :; do
+            jobs="$(api GET "/actions/runs/$RUN_ID/jobs?limit=50&page=$page" | jq -c '.jobs[]?')"
+            [ -n "$jobs" ] || break
+            while IFS= read -r -u 3 job; do
+              title="$(title_for "$(jq -r .name <<<"$job")")"
+              case "$(jq -r .conclusion <<<"$job")" in
+              success) close "$title" ;;
+              failure | timed_out) report "$title" "$job" ;;
+              esac
+            done 3<<<"$jobs"
+            [ "$(wc -l <<<"$jobs")" -ge 50 ] || break
+            page=$((page + 1))
+          done

.github/workflows/update.yml

@@ -1,10 +1,20 @@
 name: Update AUR packages
+run-name: ${{ inputs.package && format('Update {0}', inputs.package) || 'Update AUR packages' }}
 
 on:
   schedule:
-    # every 6 hours (offset from the full hour to avoid GitHub's load spikes)
+    # every 6 hours, off the full hour
     - cron: '37 */6 * * *'
   workflow_dispatch:
+    inputs:
+      package:
+        # A few packages instead of all of them: a full run builds every
+        # package in turn, and one near the end of the list waits behind every
+        # source build before it gets its turn.
+        description: 'Only update these package directories, comma-separated (empty: all packages)'
+        type: string
+        required: false
+        default: ''
   push:
     branches: [main]
     paths:
@@ -12,6 +22,13 @@ on:
       - '*/*'
       - '.github/workflows/update.yml'
 
+# Never run twice at once: concurrent runs race on pushing to this repository
+# and to the AUR (e.g. a push-triggered run and a manual dispatch both creating
+# a new AUR repo). Queue instead of cancelling so every trigger still lands.
+concurrency:
+  group: aur-update
+  cancel-in-progress: false
+
 permissions:
   contents: write
 
@@ -21,10 +38,34 @@ jobs:
     outputs:
       packages: ${{ steps.list.outputs.packages }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - id: list
+        env:
+          PACKAGES: ${{ inputs.package }}
         run: |
-          echo "packages=$(ls -d */PKGBUILD 2>/dev/null | xargs -r -n1 dirname | jq -R . | jq -cs .)" >> "$GITHUB_OUTPUT"
+          if [ -n "$PACKAGES" ]; then
+            # split on commas, trim, drop empty entries and duplicates, keep
+            # the given order (it is the build order)
+            packages=$(jq -cn --arg s "$PACKAGES" '
+              $s | split(",") | map(gsub("^\\s+|\\s+$"; "") | select(. != ""))
+              | reduce .[] as $p ([]; if any(.[]; . == $p) then . else . + [$p] end)')
+            if [ "$packages" = "[]" ]; then
+              echo "::error::no package name in '$PACKAGES'"
+              exit 1
+            fi
+            # report every unknown name at once, not just the first
+            missing=0
+            while IFS= read -r p; do
+              if [ ! -f "$p/PKGBUILD" ]; then
+                echo "::error::there is no package directory named '$p'"
+                missing=1
+              fi
+            done < <(jq -r '.[]' <<< "$packages")
+            [ "$missing" = 0 ] || exit 1
+            echo "packages=$packages" >> "$GITHUB_OUTPUT"
+          else
+            echo "packages=$(ls -d */PKGBUILD 2>/dev/null | xargs -r -n1 dirname | jq -R . | jq -cs .)" >> "$GITHUB_OUTPUT"
+          fi
 
   update:
     needs: discover
@@ -38,17 +79,18 @@ jobs:
       max-parallel: 1
       matrix:
         package: ${{ fromJson(needs.discover.outputs.packages) }}
-    env:
-      GH_TOKEN: ${{ github.token }}
     steps:
+      # nodejs: actions/checkout is a JavaScript action, and the Gitea runner
+      # runs it inside this container
       - name: Install base tooling
-        run: pacman -Syu --noconfirm --needed git openssh github-cli jq zstd
+        run: pacman -Syu --noconfirm --needed git openssh jq zstd nodejs
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Update ${{ matrix.package }}
         env:
           AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          GITHUB_API_TOKEN: ${{ secrets.GITHUB_API_TOKEN }}
           AUR_GIT_NAME: ${{ vars.AUR_GIT_NAME }}
           AUR_GIT_EMAIL: ${{ secrets.AUR_GIT_EMAIL }}
         run: bash scripts/update-package.sh "${{ matrix.package }}"

.gitignore

@@ -1,6 +1,10 @@
 # makepkg build leftovers and downloaded/built artifacts
 *.tar.zst
 *.tar.gz
+*.tar.bz2
 *.pkg.tar.*
 */src/
 */pkg/
+*.deb
+*.AppImage
+*.flatpak

CLAUDE.md

@@ -0,0 +1,26 @@
+# CLAUDE.md
+
+## Style
+
+- Keep everything short: replies, explanations, comments, docs.
+- Use simple English: short sentences, common words.
+- Avoid em dashes (—). Do not just swap them for "-" either. Rewrite the sentence instead, for
+  example with a comma, a colon, brackets or two sentences.
+
+## Commits
+
+- English only.
+- Subject: `<package>: <what changed>`, the way CI writes it, for example
+  `plezy-bin: update to 2.21.0-1` or `bottles-opener: new package`. Several packages at once:
+  list them separated by commas.
+- Subject as short as possible. Imperative, lowercase, no trailing period.
+- Body only when something genuinely cannot be inferred from the diff.
+- Never add `Co-Authored-By`, "Generated with" or any other AI attribution to commits or PR descriptions.
+
+## Packages
+
+- Read README.md first. The ground rule there decides what a package may do: this repository never
+  hosts a binary of our own, and `-bin` is only for what upstream published.
+- One directory per package with `PKGBUILD` and `pkg.sh`. `pkg.sh` tells CI how to find the newest
+  version and how to refresh the checksums.
+- Never bump `pkgver` or checksums by hand: CI does that every six hours.

README.md

@@ -1,28 +1,85 @@
 # PKGBUILDS
 
-Automated `-bin` packages for the [AUR](https://aur.archlinux.org), kept up to
+Automated AUR packages, kept up to date by Gitea Actions on
-date by GitHub Actions.
+[git.felo.gg](https://git.felo.gg/Felitendo/PKGBUILDS).
 
 Every 6 hours the [update workflow](.github/workflows/update.yml) checks each
 package's upstream for a new release. When one is found it:
 
-1. builds the software in an Arch Linux container,
+1. updates the `PKGBUILD` (pkgver/pkgrel/sha256sums),
-2. publishes the resulting install tree as a `.tar.zst` asset on a GitHub
+2. test-builds it with `makepkg` and regenerates `.SRCINFO`,
-   release of **this** repository (tag `<pkgname>-<version>`),
+3. commits the changes back to this repository, and
-3. updates the `PKGBUILD` (pkgver/pkgrel/sha256sums), test-builds it with
+4. pushes the package files to the AUR.
-   `makepkg` and regenerates `.SRCINFO`,
-4. commits the changes back to this repository, and
-5. pushes `PKGBUILD` + `.SRCINFO` to the AUR.
 
-The AUR packages themselves only download the prebuilt asset from step 2, so
+If a package fails to update, the [notify workflow](.github/workflows/notify.yml)
-users don't need any build dependencies.
+opens an issue for it. The issue closes once that package updates again.
+
+## Ground rule
+
+**This repository never hosts a binary.** Every `PKGBUILD` sources what
+*upstream* published — a release tarball, `.deb`, wheel or AppImage — and
+either repackages it (`-bin`) or builds it (no suffix), exactly like any
+hand-written AUR package would. CI only bumps `pkgver` and the checksums.
+
+This is not a style preference. The
+[AUR submission guidelines](https://wiki.archlinux.org/title/AUR_submission_guidelines#Rules_of_submission)
+say:
+
+> Packages that use **prebuilt** deliverables, when the sources are available,
+> must use the `-bin` suffix. […] The AUR should not contain the binary
+> tarball created by makepkg
+
+A `-bin` package repackages what upstream ships. Building the software
+yourself, publishing the result as a release asset and having the AUR
+`PKGBUILD` download *that* makes this repository an unofficial binary
+repository — users can no longer verify that the package matches what
+upstream released. Packages set up that way were removed from the AUR in
+July 2026; do not reintroduce the pattern.
+
+If upstream ships no Linux binary, there are exactly two options: build from
+source in the `PKGBUILD` (and drop the `-bin` suffix), or don't package it.
 
 ## Packages
 
-| Package | Upstream | AUR |
+| Package | Upstream | Upstream deliverable | AUR |
-|---|---|---|
+|---|---|---|---|
-| `timetable-bin` | [ostfriese4/untis](https://codeberg.org/ostfriese4/untis) — "Timetable", a GTK4 + LibAdwaita client for WebUntis | [timetable-bin](https://aur.archlinux.org/packages/timetable-bin) |
+| `bottles-opener` | [LoonixTools/bottles-opener](https://git.felo.gg/LoonixTools/bottles-opener) — double-click a file and it opens in its Windows program inside Bottles, with the file types and icons from the bottle's registry | *built from source* | [bottles-opener](https://aur.archlinux.org/packages/bottles-opener) |
-| `fluxer-bin` | [fluxer.app](https://fluxer.app) — Fluxer desktop client (Electron) | [fluxer-bin](https://aur.archlinux.org/packages/fluxer-bin) |
+| `bt-volume-step` | [LoonixTools/bt-volume-step](https://git.felo.gg/LoonixTools/bt-volume-step) — corrects the coarse internal volume grid of Bluetooth audio devices on PipeWire | *built from source* | [bt-volume-step](https://aur.archlinux.org/packages/bt-volume-step) |
+| `cachy-auto-update` | [LoonixTools/cachy-auto-update](https://git.felo.gg/LoonixTools/cachy-auto-update) — unattended background updates for CachyOS (pacman, AUR, Flatpak, AppImages) | *built from source* | [cachy-auto-update](https://aur.archlinux.org/packages/cachy-auto-update) |
+| `capture-studio-bin` | [tenzen.studio](https://tenzen.studio): Capture Studio by Tenzen Studio, screen recorder and editor for product demos (proprietary Electron app). Called `tenzen-studio-bin` before | Flatpak bundle | [capture-studio-bin](https://aur.archlinux.org/packages/capture-studio-bin) |
+| `chiaki-ng-bin` | [streetpea/chiaki-ng](https://github.com/streetpea/chiaki-ng) — PlayStation Remote Play client (Qt6) | AppImage | [chiaki-ng-bin](https://aur.archlinux.org/packages/chiaki-ng-bin) |
+| `chromium-widevine-helper` | [GloriousEggroll/chromium-widevine-helper](https://github.com/GloriousEggroll/chromium-widevine-helper) — extension + native helper installing Google's Widevine CDM into Chromium-based browser profiles | *no build step* | [chromium-widevine-helper](https://aur.archlinux.org/packages/chromium-widevine-helper) |
+| `concat` | [jub0t/Concat](https://github.com/jub0t/Concat) — free and open-source CapCut replacement (a Slint window over a Rust video engine) | *built from source* | [concat](https://aur.archlinux.org/packages/concat) |
+| `concat-bin` | [jub0t/Concat](https://github.com/jub0t/Concat) — prebuilt release of `concat` | `.deb` | [concat-bin](https://aur.archlinux.org/packages/concat-bin) |
+| `concat-git` | [jub0t/Concat](https://github.com/jub0t/Concat) — `main` branch of `concat` | *built from source* | [concat-git](https://aur.archlinux.org/packages/concat-git) |
+| `face-unlock` | [LoonixTools/face-unlock](https://git.felo.gg/LoonixTools/face-unlock): Face ID for Linux, for the lock screen, sudo and admin prompts on Plasma, GNOME, Hyprland and Niri, with a photo check (C++/Qt6, OpenCV). Called `plasma-face-unlock` before 2.0.0 | *built from source* | [face-unlock](https://aur.archlinux.org/packages/face-unlock) |
+| `face-unlock-bin` | [LoonixTools/face-unlock](https://git.felo.gg/LoonixTools/face-unlock): prebuilt release of `face-unlock`, with OpenCV linked in | tarball (built on Arch) | [face-unlock-bin](https://aur.archlinux.org/packages/face-unlock-bin) |
+| `faugus-launcher-bin` | [Faugus/faugus-launcher](https://github.com/Faugus/faugus-launcher) — launcher for Windows games via UMU-Launcher | `.deb` (`all`) | [faugus-launcher-bin](https://aur.archlinux.org/packages/faugus-launcher-bin) |
+| `fluxer-bin` | [fluxer.app](https://fluxer.app) — Fluxer desktop client (Electron) | tarball | [fluxer-bin](https://aur.archlinux.org/packages/fluxer-bin) |
+| `kitty-tune-bin` | [alan7383/KittyTuneDesktop](https://github.com/alan7383/KittyTuneDesktop) — SoundCloud and YouTube music player (Kotlin/Compose Multiplatform) | `.deb` | [kitty-tune-bin](https://aur.archlinux.org/packages/kitty-tune-bin) |
+| `lunar-client-bin` | [lunarclient.com](https://lunarclient.com) — Minecraft PvP modpack launcher | AppImage | [lunar-client-bin](https://aur.archlinux.org/packages/lunar-client-bin) |
+| `middleclick-autoscroll` | [LoonixTools/middleclick-autoscroll](https://git.felo.gg/LoonixTools/middleclick-autoscroll) — enables middle-click autoscroll in every application that supports it | *built from source* | [middleclick-autoscroll](https://aur.archlinux.org/packages/middleclick-autoscroll) |
+| `modrinth-app-bin` | [modrinth/code](https://github.com/modrinth/code) — Minecraft mod manager/launcher | `.deb` | [modrinth-app-bin](https://aur.archlinux.org/packages/modrinth-app-bin) |
+| `modrinth-enhanced` | [Felitendo/Modrinth-Enhanced](https://git.felo.gg/Felitendo/Modrinth-Enhanced) — Modrinth App without ads or telemetry, with offline and Ely.by accounts (a patch series on top of each Modrinth App release) | *built from source* | [modrinth-enhanced](https://aur.archlinux.org/packages/modrinth-enhanced) |
+| `modrinth-enhanced-bin` | [Felitendo/Modrinth-Enhanced](https://git.felo.gg/Felitendo/Modrinth-Enhanced) — prebuilt release of `modrinth-enhanced` | `.deb` | [modrinth-enhanced-bin](https://aur.archlinux.org/packages/modrinth-enhanced-bin) |
+| `moondeckbuddy` | [FrogTheFrog/moondeck-buddy](https://github.com/FrogTheFrog/moondeck-buddy) — host companion of the MoonDeck Steam Deck plugin (C++/Qt6) | *built from source* | [moondeckbuddy](https://aur.archlinux.org/packages/moondeckbuddy) |
+| `moondeckbuddy-bin` | [FrogTheFrog/moondeck-buddy](https://github.com/FrogTheFrog/moondeck-buddy) — prebuilt release of `moondeckbuddy` | AppImage | *not published yet* |
+| `moonlight-vrr` | [Nonary/moonlight-qt](https://github.com/Nonary/moonlight-qt): fork of the Moonlight game streaming client with smooth VRR pacing and the PyroWave codec (C++/Qt6) | *built from source* | [moonlight-vrr](https://aur.archlinux.org/packages/moonlight-vrr) |
+| `moonlight-vrr-bin` | [Nonary/moonlight-qt](https://github.com/Nonary/moonlight-qt): prebuilt release of `moonlight-vrr`, built by upstream without Wayland support (runs through XWayland) | AppImage | [moonlight-vrr-bin](https://aur.archlinux.org/packages/moonlight-vrr-bin) |
+| `nextcloud-native` | [Obiente/native](https://github.com/Obiente/native) — adaptive native Nextcloud client for files, media and installed server apps (Compose Multiplatform, unofficial) | *built from source* | [nextcloud-native](https://aur.archlinux.org/packages/nextcloud-native) |
+| `nextcloud-native-bin` | [Obiente/native](https://github.com/Obiente/native) — prebuilt release of `nextcloud-native` | `.deb` | [nextcloud-native-bin](https://aur.archlinux.org/packages/nextcloud-native-bin) |
+| `nextcloud-native-git` | [Obiente/native](https://github.com/Obiente/native) — `main` branch of `nextcloud-native` | *built from source* | [nextcloud-native-git](https://aur.archlinux.org/packages/nextcloud-native-git) |
+| `plezy-bin` | [edde746/plezy](https://github.com/edde746/plezy) — Plex, Jellyfin and Emby client (Flutter); the source package [lives in `extra`](https://archlinux.org/packages/extra/x86_64/plezy/) | `.deb` | [plezy-bin](https://aur.archlinux.org/packages/plezy-bin) |
+| `schist` | [Infrawrench/schist](https://github.com/Infrawrench/schist): layered image editor with PSD and Affinity support (Rust/gpui, alpha) | *built from source* | [schist](https://aur.archlinux.org/packages/schist) |
+| `schist-bin` | [Infrawrench/schist](https://github.com/Infrawrench/schist): prebuilt release of `schist` | `.pkg.tar.zst` | [schist-bin](https://aur.archlinux.org/packages/schist-bin) |
+| `sharpemu-bin` | [sharpemu/sharpemu](https://github.com/sharpemu/sharpemu) — experimental PlayStation 5 emulator | tarball | [sharpemu-bin](https://aur.archlinux.org/packages/sharpemu-bin) |
+| `snapx-bin` | [SnapXL/SnapX](https://github.com/SnapXL/SnapX) — ShareX-fork screenshot/sharing tool | self-contained tarball | [snapx-bin](https://aur.archlinux.org/packages/snapx-bin) |
+| `untix` | [ostfriese4/untix](https://codeberg.org/ostfriese4/untix): "Timetable", a GTK4 + LibAdwaita client for WebUntis. Called `untis` and `timetable` on the AUR before | *built from source* | [untix](https://aur.archlinux.org/packages/untix) |
+| `untix-git` | [ostfriese4/untix](https://codeberg.org/ostfriese4/untix): `main` branch of `untix` | *built from source* | [untix-git](https://aur.archlinux.org/packages/untix-git) |
+| `vacuumtube-bin` | [shy1132/VacuumTube](https://github.com/shy1132/VacuumTube) — YouTube Leanback (TV UI) with built-in adblocker | `.deb` | [vacuumtube-bin](https://aur.archlinux.org/packages/vacuumtube-bin) |
+| `waydroid-helper-bin` | [waydroid-helper/waydroid-helper](https://github.com/waydroid-helper/waydroid-helper) — GTK4 GUI for Waydroid configuration and extensions | AppImage | [waydroid-helper-bin](https://aur.archlinux.org/packages/waydroid-helper-bin) |
+| `wiiudownloader-bin` | [Xpl0itU/WiiUDownloader](https://github.com/Xpl0itU/WiiUDownloader) — Wii U title downloader (Go + GTK4) | AppImage | [wiiudownloader-bin](https://aur.archlinux.org/packages/wiiudownloader-bin) |
+| `zapzap-bin` | [rafatosta/zapzap](https://github.com/rafatosta/zapzap) — WhatsApp desktop client (PyQt6 + WebEngine) | wheel | [zapzap-bin](https://aur.archlinux.org/packages/zapzap-bin) |
 
 ## Setup (one-time)
 
@@ -30,37 +87,61 @@ users don't need any build dependencies.
    public key to it (AUR account settings).
 2. Add the matching **private** key as a repository secret named
    `AUR_SSH_PRIVATE_KEY`
-   (Settings → Secrets and variables → Actions → New repository secret).
+   (Settings → Actions → Secrets → Add secret), **base64-encoded on one line**
+   (`base64 -w0 < key`). The Gitea runner prints each step's environment and
+   does not mask a multi-line secret, so a plain key would end up in the log.
 3. Optionally set the repository variable `AUR_GIT_NAME` and the repository
    **secret** `AUR_GIT_EMAIL` to control the commit identity used on the AUR
-   (defaults: `Felitendo` / the maintainer's GitHub noreply address).
+   (defaults: `Felitendo` / the maintainer's old GitHub noreply address).
+4. Optionally add a GitHub token (no scopes needed) as the secret
+   `GITHUB_API_TOKEN`. Packages ask the GitHub API about upstream releases;
+   without a token those calls are anonymous and share 60 per hour.
+
+The runner needs the `ubuntu-latest` label and Docker: every package is built
+in an `archlinux:base-devel` container.
 
 The first push to `ssh://aur@aur.archlinux.org/<pkgname>.git` creates the AUR
 package automatically.
 
 ## Adding a package
 
-Create a new directory named after the AUR package containing:
+Check first that upstream actually publishes a Linux binary, that the package
+is not already in the **official repositories** (the AUR rejects the push
+outright: "package already provided by [extra]"), and that the AUR does not
+already carry an equivalent package — a `-bin` next to a maintained
+source package is fine, a second copy of the same thing is not.
 
-- **`PKGBUILD`** — sources the prebuilt asset from
+Then create a directory named after the AUR package containing:
-  `https://github.com/Felitendo/PKGBUILDS/releases/download/<pkgname>-<pkgver>/<pkgname>-<pkgver>.tar.zst`.
-  `pkgver`, `pkgrel` and `sha256sums` are maintained by CI.
-- **`pkg.sh`** — bash sourced by [scripts/update-package.sh](scripts/update-package.sh).
-  Always provides `latest_version` (prints the latest upstream version, no
-  `v` prefix), plus one of two modes:
-  - *upstream has no binaries* (e.g. `timetable-bin`): define
-    `build_artifact <version> <output-file>` (build upstream and write the
-    install tree as a tarball containing `usr/`) and `BUILD_DEPS` (array of
-    Arch packages needed to build). CI hosts the result as a GitHub release
-    asset which the PKGBUILD downloads.
-  - *upstream hosts binaries* (e.g. `fluxer-bin`): define
-    `refresh_checksums <version> <pkgbuild-path>` which updates the
-    `sha256sums*` lines for the new version. The PKGBUILD sources upstream
-    URLs directly and nothing is hosted here.
 
-  Other local source files in the directory (`.desktop` files, etc.) are
+- **`PKGBUILD`** — sources upstream's release URLs directly. `pkgver`,
+  `pkgrel` and `sha256sums` are maintained by CI, so keep `sha256sums` on a
+  single line.
+- **`pkg.sh`** — bash sourced by [scripts/update-package.sh](scripts/update-package.sh),
+  defining:
+  - `latest_version` — prints the latest upstream version, no `v` prefix. A
+    channel that has stopped pointing at a release can return `75`
+    (`EX_TEMPFAIL`) instead: the run then warns, keeps the version the
+    `PKGBUILD` has and carries on, so packaging changes still reach the AUR
+    (`fluxer-bin`).
+  - `refresh_checksums <version> <pkgbuild-path>` — updates the `sha256sums*`
+    lines for that version. If the asset name carries build metadata that does
+    not follow from `pkgver` (see `snapx-bin`, `faugus-launcher-bin`), resolve
+    it via the GitHub API here and sync an `_asset` variable in the `PKGBUILD`
+    too.
+  - `BUILD_DEPS` — optional array of Arch packages to install before the CI
+    test build; only needed by packages that build from source or need a
+    tool to unpack upstream's deliverable (`capture-studio-bin`: `ostree`).
+  - `AUR_PUBLISH` — optional; set to `false` to keep a package out of the AUR
+    while it is still being prepared. Everything else still runs, so the
+    `PKGBUILD` is kept current and test-built; only the publishing waits.
+    Flip it to `true` to go live (`moondeckbuddy-bin`). `face-unlock-bin` sets it
+    itself: it goes live with the first release that has its tarball.
+
+  Other local source files in the directory (`.desktop` files, patches, …) are
   pushed to the AUR alongside `PKGBUILD` and `.SRCINFO`.
 
 The workflow discovers package directories automatically. Trigger a run
 manually via *Actions → Update AUR packages → Run workflow* to publish it
-immediately.
+immediately. To update only some packages, enter their directory names,
+separated by commas (e.g. `concat, plezy-bin`); leave the field empty to update
+all of them.

bottles-opener/.SRCINFO

@@ -0,0 +1,28 @@
+pkgbase = bottles-opener
+	pkgdesc = Double-click a file and it opens in its Windows program, inside its Bottles bottle
+	pkgver = 0.1.1
+	pkgrel = 1
+	url = https://git.felo.gg/LoonixTools/bottles-opener
+	install = bottles-opener.install
+	arch = any
+	license = GPL-3.0-or-later
+	makedepends = gettext
+	makedepends = scdoc
+	depends = bash
+	depends = coreutils
+	depends = gawk
+	depends = grep
+	depends = sed
+	depends = gettext
+	depends = shared-mime-info
+	depends = systemd
+	optdepends = bottles: Bottles itself (the Flatpak works too)
+	optdepends = python-yaml: read bottles without starting the Bottles Flatpak
+	optdepends = icoextract: extract file icons without starting the Bottles Flatpak
+	optdepends = libnotify: report files that could not be opened
+	optdepends = desktop-file-utils: refresh the desktop database after a change
+	optdepends = flatpak: open files with the Bottles Flatpak
+	source = bottles-opener-0.1.1.tar.gz::https://git.felo.gg/LoonixTools/bottles-opener/archive/v0.1.1.tar.gz
+	sha256sums = 3ec601cd59006e72d3b4c1d20b8967aad77b7baf20525d8ff53a7ae4f4822bd9
+
+pkgname = bottles-opener

bottles-opener/PKGBUILD

@@ -0,0 +1,32 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=bottles-opener
+pkgver=0.1.1
+pkgrel=1
+pkgdesc="Double-click a file and it opens in its Windows program, inside its Bottles bottle"
+arch=('any')
+url="https://git.felo.gg/LoonixTools/bottles-opener"
+license=('GPL-3.0-or-later')
+depends=('bash' 'coreutils' 'gawk' 'grep' 'sed' 'gettext' 'shared-mime-info' 'systemd')
+makedepends=('gettext' 'scdoc')
+optdepends=('bottles: Bottles itself (the Flatpak works too)'
+            'python-yaml: read bottles without starting the Bottles Flatpak'
+            'icoextract: extract file icons without starting the Bottles Flatpak'
+            'libnotify: report files that could not be opened'
+            'desktop-file-utils: refresh the desktop database after a change'
+            'flatpak: open files with the Bottles Flatpak')
+install="${pkgname}.install"
+source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
+sha256sums=('3ec601cd59006e72d3b4c1d20b8967aad77b7baf20525d8ff53a7ae4f4822bd9')
+
+build() {
+  # pass the version being packaged so `bottles-opener --version` cannot drift
+  # away from pkgver
+  make -C "${pkgname}" VERSION="$pkgver"
+}
+
+package() {
+  make -C "${pkgname}" VERSION="$pkgver" DESTDIR="$pkgdir" install
+}

bottles-opener/bottles-opener.install

@@ -0,0 +1,28 @@
+post_install() {
+  cat <<'MSG'
+
+  bottles-opener is installed but not active yet.
+
+    bottles-opener          interactive menu
+    bottles-opener enable   set up file opening for your bottles
+
+  Run it as your own user, not with sudo: it only ever writes inside your own
+  home directory.
+
+MSG
+}
+
+pre_remove() {
+  # The changes live in each user's home and cannot be undone from a root-run
+  # hook, so say so while the command that does it still exists.
+  cat <<'MSG'
+
+  Before removing this package, run
+
+    bottles-opener disable
+
+  as each user that enabled it. That removes the file types, launchers and
+  icons it added and puts back the previous default applications.
+
+MSG
+}

bottles-opener/pkg.sh

@@ -0,0 +1,28 @@
+# bottles-opener - opens files in their Windows program inside Bottles
+# (https://git.felo.gg/LoonixTools/bottles-opener).
+#
+# Shell and two small Python scripts, a gettext catalog and a scdoc man page:
+# the PKGBUILD runs the upstream Makefile against the release tarball.
+
+UPSTREAM_REPO="LoonixTools/bottles-opener"
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(gettext scdoc)
+
+latest_version() {
+  # the highest vX.Y.Z tag; not every release has a release page
+  curl -sf "https://git.felo.gg/api/v1/repos/$UPSTREAM_REPO/tags?limit=50" \
+    | jq -r '.[].name | select(test("^v[0-9]+(\\.[0-9]+)*$"))' \
+    | sed 's/^v//' | sort -V | tail -n 1
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local sha
+
+  sha="$(curl -sfL "https://git.felo.gg/$UPSTREAM_REPO/archive/v$ver.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i "s|^sha256sums=.*|sha256sums=('$sha')|" "$pkgbuild"
+}

bt-volume-step/.SRCINFO

@@ -0,0 +1,16 @@
+pkgbase = bt-volume-step
+	pkgdesc = Fixed volume steps for Bluetooth audio devices on PipeWire
+	pkgver = 1.0.0
+	pkgrel = 1
+	url = https://git.felo.gg/LoonixTools/bt-volume-step
+	install = bt-volume-step.install
+	arch = any
+	license = BSD-3-Clause
+	depends = python
+	depends = libpulse
+	optdepends = kconfig: follow the KDE Plasma volume step setting
+	optdepends = bluez-utils: device names in --show
+	source = bt-volume-step-1.0.0.tar.gz::https://git.felo.gg/LoonixTools/bt-volume-step/archive/v1.0.0.tar.gz
+	sha256sums = 32373fd4440dcd7bd19988f78675f9cf400ec7ebe51a828bbd9468ee0c5a18dc
+
+pkgname = bt-volume-step

bt-volume-step/PKGBUILD

@@ -0,0 +1,33 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=bt-volume-step
+pkgver=1.0.0
+pkgrel=1
+pkgdesc="Fixed volume steps for Bluetooth audio devices on PipeWire"
+arch=('any')
+url="https://git.felo.gg/LoonixTools/bt-volume-step"
+license=('BSD-3-Clause')
+depends=('python' 'libpulse')
+optdepends=('kconfig: follow the KDE Plasma volume step setting'
+            'bluez-utils: device names in --show')
+# Arch packages never enable units themselves (the default preset is
+# "disable *"), and a user unit could not be enabled from a pacman transaction
+# anyway - it runs as root, without the user's session bus. Print the command
+# instead.
+install="${pkgname}.install"
+source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
+sha256sums=('32373fd4440dcd7bd19988f78675f9cf400ec7ebe51a828bbd9468ee0c5a18dc')
+
+check() {
+  cd "${pkgname}"
+  make check
+}
+
+package() {
+  cd "${pkgname}"
+  make install PREFIX=/usr DESTDIR="$pkgdir"
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 README.md -t "$pkgdir/usr/share/doc/$pkgname"
+}

bt-volume-step/bt-volume-step.install

@@ -0,0 +1,10 @@
+post_install() {
+  cat <<'EOF'
+==> bt-volume-step ships a systemd user unit. Enable it for your session:
+==>
+==>     systemctl --user enable --now bt-volume-step
+==>
+==> Then use the volume control on a connected Bluetooth device a few times:
+==> the daemon measures that device's volume grid before it starts correcting.
+EOF
+}

bt-volume-step/pkg.sh

@@ -0,0 +1,29 @@
+# bt-volume-step - fixed volume steps for Bluetooth audio devices on PipeWire
+# (https://git.felo.gg/LoonixTools/bt-volume-step).
+#
+# Nothing is compiled: the payload is a single Python script plus a systemd
+# user unit, installed by the upstream Makefile. Sourced from the release
+# tarball, so this is a source package without a -bin suffix.
+
+UPSTREAM_REPO="LoonixTools/bt-volume-step"
+
+# Installed in CI (pacman) before the makepkg test build. check() runs the
+# upstream test suite, which needs nothing beyond python.
+BUILD_DEPS=(python)
+
+latest_version() {
+  # the highest vX.Y.Z tag; not every release has a release page
+  curl -sf "https://git.felo.gg/api/v1/repos/$UPSTREAM_REPO/tags?limit=50" \
+    | jq -r '.[].name | select(test("^v[0-9]+(\\.[0-9]+)*$"))' \
+    | sed 's/^v//' | sort -V | tail -n 1
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local sha
+  sha="$(curl -sfL \
+    "https://git.felo.gg/$UPSTREAM_REPO/archive/v$ver.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+  sed -i "s|^sha256sums=.*|sha256sums=('$sha')|" "$pkgbuild"
+}

cachy-auto-update/.SRCINFO

@@ -0,0 +1,30 @@
+pkgbase = cachy-auto-update
+	pkgdesc = Unattended background updates for CachyOS, aware of battery, gaming and manual package management
+	pkgver = 1.3.2
+	pkgrel = 1
+	url = https://git.felo.gg/LoonixTools/cachy-auto-update
+	install = cachy-auto-update.install
+	arch = any
+	license = GPL-3.0-or-later
+	makedepends = gettext
+	makedepends = scdoc
+	depends = bash
+	depends = systemd
+	depends = pacman
+	depends = pacman-contrib
+	depends = util-linux
+	depends = sudo
+	depends = gettext
+	optdepends = paru: AUR package updates
+	optdepends = yay: AUR package updates
+	optdepends = base-devel: required to build AUR packages
+	optdepends = flatpak: Flatpak updates
+	optdepends = libnotify: desktop notifications
+	optdepends = gearlever: AppImage updates
+	optdepends = python-gobject: progress bar in the desktop taskbar
+	backup = etc/cachy-auto-update/cachy-auto-update.conf
+	backup = etc/logrotate.d/cachy-auto-update
+	source = cachy-auto-update-1.3.2.tar.gz::https://git.felo.gg/LoonixTools/cachy-auto-update/archive/v1.3.2.tar.gz
+	sha256sums = 0f680d222852a72197d1b6a3cad9d093d1c06257c55d9f58144b0403dc42adec
+
+pkgname = cachy-auto-update

cachy-auto-update/PKGBUILD

@@ -0,0 +1,36 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=cachy-auto-update
+pkgver=1.3.2
+pkgrel=1
+pkgdesc="Unattended background updates for CachyOS, aware of battery, gaming and manual package management"
+arch=('any')
+url="https://git.felo.gg/LoonixTools/cachy-auto-update"
+license=('GPL-3.0-or-later')
+depends=('bash' 'systemd' 'pacman' 'pacman-contrib' 'util-linux' 'sudo'
+         'gettext')
+makedepends=('gettext' 'scdoc')
+optdepends=('paru: AUR package updates'
+            'yay: AUR package updates'
+            'base-devel: required to build AUR packages'
+            'flatpak: Flatpak updates'
+            'libnotify: desktop notifications'
+            'gearlever: AppImage updates'
+            'python-gobject: progress bar in the desktop taskbar')
+backup=('etc/cachy-auto-update/cachy-auto-update.conf'
+        'etc/logrotate.d/cachy-auto-update')
+install="${pkgname}.install"
+source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
+sha256sums=('0f680d222852a72197d1b6a3cad9d093d1c06257c55d9f58144b0403dc42adec')
+
+build() {
+  # pass the version being packaged so `cachy-auto-update --version` cannot
+  # drift away from pkgver
+  make -C "${pkgname}" VERSION="$pkgver"
+}
+
+package() {
+  make -C "${pkgname}" VERSION="$pkgver" DESTDIR="$pkgdir" install
+}

cachy-auto-update/cachy-auto-update.install

@@ -0,0 +1,37 @@
+_check_sudoers() {
+  # A malformed drop-in in /etc/sudoers.d takes sudo down for the whole
+  # machine, so say so loudly rather than leaving it to be discovered later.
+  if command -v visudo > /dev/null 2>&1; then
+    if ! visudo -cf /etc/sudoers.d/cachy-auto-update > /dev/null 2>&1; then
+      printf '\n  WARNING: /etc/sudoers.d/cachy-auto-update did not validate.\n' >&2
+      printf '  AUR updates will not work until this is resolved.\n\n' >&2
+    fi
+  fi
+}
+
+post_install() {
+  _check_sudoers
+
+  cat <<'EOF'
+
+  cachy-auto-update is installed but not active yet.
+
+    sudo cachy-auto-update          interactive setup
+    sudo cachy-auto-update enable   turn automatic updates on
+    sudo cachy-auto-update status   see what it would do right now
+
+  AUR packages are built by a locked system account that is allowed to call
+  pacman without a password (/etc/sudoers.d/cachy-auto-update). No user
+  password is stored anywhere. Set UpdateAUR=no in
+  /etc/cachy-auto-update/cachy-auto-update.conf to opt out of that entirely.
+
+EOF
+}
+
+post_upgrade() {
+  _check_sudoers
+}
+
+pre_remove() {
+  systemctl disable --now cachy-auto-update.timer > /dev/null 2>&1 || true
+}

cachy-auto-update/pkg.sh

@@ -0,0 +1,30 @@
+# cachy-auto-update - unattended background updates for CachyOS
+# (https://git.felo.gg/LoonixTools/cachy-auto-update).
+#
+# Pure shell plus a gettext catalog and a scdoc man page, so the PKGBUILD just
+# runs the upstream Makefile against the release tarball. Nothing is prebuilt
+# and nothing is republished - the AUR package builds exactly what the tag
+# contains.
+
+UPSTREAM_REPO="LoonixTools/cachy-auto-update"
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(gettext scdoc)
+
+latest_version() {
+  # the highest vX.Y.Z tag; not every release has a release page
+  curl -sf "https://git.felo.gg/api/v1/repos/$UPSTREAM_REPO/tags?limit=50" \
+    | jq -r '.[].name | select(test("^v[0-9]+(\\.[0-9]+)*$"))' \
+    | sed 's/^v//' | sort -V | tail -n 1
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local sha
+
+  sha="$(curl -sfL "https://git.felo.gg/$UPSTREAM_REPO/archive/v$ver.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i "s|^sha256sums=.*|sha256sums=('$sha')|" "$pkgbuild"
+}

capture-studio-bin/.SRCINFO

@@ -0,0 +1,25 @@
+pkgbase = capture-studio-bin
+	pkgdesc = Record and edit product demos: cut pauses, add zooms and captions (upstream Flatpak bundle)
+	pkgver = 0.1.32
+	pkgrel = 1
+	url = https://tenzen.studio
+	arch = x86_64
+	license = LicenseRef-proprietary
+	makedepends = ostree
+	makedepends = asar
+	depends = gtk3
+	depends = nss
+	depends = alsa-lib
+	depends = ffmpeg
+	depends = python-xlib
+	optdepends = libpulse: record system audio
+	provides = capture-studio
+	conflicts = capture-studio
+	conflicts = tenzen-studio-bin
+	noextract = Capture-Studio-0.1.32-linux-x64.flatpak
+	options = !strip
+	options = !debug
+	source = Capture-Studio-0.1.32-linux-x64.flatpak::https://downloads.tenzen.studio/desktop/stable/linux/0.1.32/Capture-Studio-0.1.32-linux-x64.flatpak
+	sha256sums = 80958f46ebcec4197ca77e759f98ca7e6f496205070be57c487c1fa463624e3b
+
+pkgname = capture-studio-bin

capture-studio-bin/PKGBUILD

@@ -0,0 +1,79 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=capture-studio-bin
+_pkgname=tenzen
+pkgver=0.1.32
+pkgrel=1
+pkgdesc="Record and edit product demos: cut pauses, add zooms and captions (upstream Flatpak bundle)"
+arch=('x86_64')
+url="https://tenzen.studio"
+license=('LicenseRef-proprietary')
+depends=('gtk3' 'nss' 'alsa-lib' 'ffmpeg' 'python-xlib')
+optdepends=('libpulse: record system audio')
+makedepends=('ostree' 'asar')
+provides=('capture-studio')
+# called tenzen-studio-bin on the AUR before
+conflicts=('capture-studio' 'tenzen-studio-bin')
+options=('!strip' '!debug')
+_bundle="Capture-Studio-${pkgver}-linux-x64.flatpak"
+source=("${_bundle}::https://downloads.tenzen.studio/desktop/stable/linux/${pkgver}/${_bundle}")
+noextract=("${_bundle}")
+sha256sums=('80958f46ebcec4197ca77e759f98ca7e6f496205070be57c487c1fa463624e3b')
+
+prepare() {
+  # A Flatpak bundle is an OSTree static delta carrying a single commit:
+  # apply it to a throwaway repository and check that commit out.
+  rm -rf repo flatpak
+  ostree init --repo=repo --mode=bare-user-only
+  ostree static-delta apply-offline --repo=repo "${_bundle}"
+
+  local _commit
+  _commit="$(find repo/objects -name '*.commit')"
+  _commit="$(basename "$(dirname "${_commit}")")$(basename "${_commit}" .commit)"
+  ostree checkout --repo=repo --user-mode "${_commit}" flatpak
+
+  # the bundle exports no icon - the app's own is only inside app.asar
+  asar extract-file flatpak/files/lib/com.tenzen.desktop/resources/app.asar \
+    dist/assets/brand/icon.png
+}
+
+package() {
+  install -d "${pkgdir}/opt/${pkgname}"
+  cp -a "${srcdir}/flatpak/files/lib/com.tenzen.desktop/." "${pkgdir}/opt/${pkgname}/"
+
+  install -d "${pkgdir}/usr/bin"
+  ln -s "/opt/${pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
+
+  # named after the app's desktopName, so windows are matched to the entry
+  install -Dm644 "${srcdir}/flatpak/files/share/applications/com.tenzen.desktop.desktop" \
+    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
+  sed -i \
+    -e "s|^Exec=.*|Exec=${_pkgname} %U|" \
+    -e "s|^Icon=.*|Icon=${_pkgname}|" \
+    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
+
+  # 1024x1024, which the hicolor theme has no directory for
+  install -Dm644 "${srcdir}/icon.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
+
+  # A custom licence has to ship its terms. Upstream publishes none as a file,
+  # so what goes in is the reference to the terms it is used under, next to
+  # the notices for everything bundled with it, which the app dir does carry.
+  install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<'EOF'
+Capture Studio is proprietary software, distributed by Tenzen Studio.
+
+It is not covered by a free-software licence: use is governed by the terms
+of service the vendor publishes, and redistribution of the build this
+package installs is not granted by them.
+
+Terms of service: https://tenzen.studio/legal/terms-of-service/
+EOF
+
+  ln -s "/opt/${pkgname}/resources/THIRD_PARTY_NOTICES.txt" \
+    "${pkgdir}/usr/share/licenses/${pkgname}/THIRD_PARTY_NOTICES.txt"
+  ln -s "/opt/${pkgname}/LICENSE.electron.txt" \
+    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
+  ln -s "/opt/${pkgname}/LICENSES.chromium.html" \
+    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
+}

capture-studio-bin/pkg.sh

@@ -0,0 +1,33 @@
+# capture-studio-bin - Capture Studio by Tenzen Studio (https://tenzen.studio),
+# a proprietary Electron app for recording and editing product demos.
+#
+# Upstream publishes no source, so there is only this -bin package. For Linux
+# it ships nothing but a Flatpak bundle, versioned on its own download host:
+# the PKGBUILD unpacks that with ostree (a Flatpak bundle is an OSTree static
+# delta) and takes the icon out of app.asar, so the test build needs both.
+#
+# The release API names the current version and lists every artifact with its
+# sha256, so nothing has to be downloaded to refresh the checksum - makepkg's
+# test build verifies it against the real download anyway.
+
+API="https://tenzen.studio/api/v1/desktop/releases/latest?channel=stable"
+
+BUILD_DEPS=(ostree asar)
+
+latest_version() {
+  curl -sf "$API" | jq -r '.release.version'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2" sha
+
+  sha="$(curl -sf "$API" | jq -r --arg f "Capture-Studio-$ver-linux-x64.flatpak" \
+    '.release.artifacts[] | select(.file_name == $f) | .sha256')"
+  if [[ ! "$sha" =~ ^[0-9a-f]{64}$ ]]; then
+    echo "the release API lists no Capture-Studio-$ver-linux-x64.flatpak" >&2
+    return 1
+  fi
+
+  sed -i "s|^sha256sums=.*|sha256sums=('$sha')|" "$pkgbuild"
+}

chiaki-ng-bin/.SRCINFO

@@ -0,0 +1,42 @@
+pkgbase = chiaki-ng-bin
+	pkgdesc = Free and Open Source PlayStation Remote Play client (upstream AppImage)
+	pkgver = 1.10.0
+	pkgrel = 2
+	url = https://streetpea.github.io/chiaki-ng/
+	arch = x86_64
+	license = LicenseRef-AGPL-3.0-only-OpenSSL
+	depends = glibc
+	depends = gcc-libs
+	depends = zlib
+	depends = bzip2
+	depends = brotli
+	depends = expat
+	depends = libgpg-error
+	depends = e2fsprogs
+	depends = fontconfig
+	depends = freetype2
+	depends = alsa-lib
+	depends = libx11
+	depends = libxcb
+	depends = libdrm
+	depends = libva
+	depends = libglvnd
+	depends = mesa
+	depends = vulkan-icd-loader
+	depends = hicolor-icon-theme
+	optdepends = intel-media-driver: vaapi backend for Intel GPUs [>= Broadwell]
+	optdepends = libva-intel-driver: vaapi backend for Intel GPUs [<= Haswell]
+	optdepends = libva-mesa-driver: vaapi backend for AMD GPUs
+	provides = chiaki-ng
+	provides = chiaki
+	conflicts = chiaki-ng
+	conflicts = chiaki
+	noextract = chiaki-ng-bin-1.10.0.AppImage
+	options = !strip
+	options = !debug
+	source = chiaki-ng-bin-1.10.0.AppImage::https://github.com/streetpea/chiaki-ng/releases/download/v1.10.0/chiaki-ng.AppImage_x86_64
+	source = COPYING-1.10.0::https://raw.githubusercontent.com/streetpea/chiaki-ng/v1.10.0/COPYING
+	sha256sums = cac42c21a19a111f2f0729bb9eef7d3878c6d2a4f06e017d383aff2aba719fd3
+	sha256sums = fff3acb5eddbde97746cc1ad2082a1e95f50c2315a8748b26b8a81a499d8d216
+
+pkgname = chiaki-ng-bin

chiaki-ng-bin/PKGBUILD

@@ -0,0 +1,64 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=chiaki-ng-bin
+pkgver=1.10.0
+pkgrel=2
+pkgdesc="Free and Open Source PlayStation Remote Play client (upstream AppImage)"
+arch=('x86_64')
+url="https://streetpea.github.io/chiaki-ng/"
+license=('LicenseRef-AGPL-3.0-only-OpenSSL')
+# the AppImage bundles Qt6, ffmpeg, SDL and the rest of the stack; these are
+# what is left over
+depends=('glibc' 'gcc-libs' 'zlib' 'bzip2' 'brotli' 'expat' 'libgpg-error'
+         'e2fsprogs' 'fontconfig' 'freetype2' 'alsa-lib' 'libx11' 'libxcb'
+         'libdrm' 'libva' 'libglvnd' 'mesa' 'vulkan-icd-loader'
+         'hicolor-icon-theme')
+optdepends=('intel-media-driver: vaapi backend for Intel GPUs [>= Broadwell]'
+            'libva-intel-driver: vaapi backend for Intel GPUs [<= Haswell]'
+            'libva-mesa-driver: vaapi backend for AMD GPUs')
+provides=('chiaki-ng' 'chiaki')
+conflicts=('chiaki-ng' 'chiaki')
+options=('!strip' '!debug')
+source=("${pkgname}-${pkgver}.AppImage::https://github.com/streetpea/chiaki-ng/releases/download/v${pkgver}/chiaki-ng.AppImage_x86_64"
+        "COPYING-${pkgver}::https://raw.githubusercontent.com/streetpea/chiaki-ng/v${pkgver}/COPYING")
+noextract=("${pkgname}-${pkgver}.AppImage")
+sha256sums=('cac42c21a19a111f2f0729bb9eef7d3878c6d2a4f06e017d383aff2aba719fd3' 'fff3acb5eddbde97746cc1ad2082a1e95f50c2315a8748b26b8a81a499d8d216')
+
+prepare() {
+  chmod +x "$srcdir/${pkgname}-${pkgver}.AppImage"
+  "$srcdir/${pkgname}-${pkgver}.AppImage" --appimage-extract > /dev/null
+}
+
+package() {
+  local _root="$srcdir/squashfs-root"
+
+  # upstream's AppImage payload, installed unchanged
+  install -d "$pkgdir/opt/$pkgname"
+  cp -a "$_root/." "$pkgdir/opt/$pkgname/"
+  rm -f "$pkgdir/opt/$pkgname/.DirIcon"
+
+  # the binaries carry a RUNPATH into the bundle and read the qt.conf next to
+  # them, so they have to be exec'd where they are
+  install -d "$pkgdir/usr/bin"
+  local _bin
+  for _bin in chiaki chiaki-cli; do
+    cat > "$pkgdir/usr/bin/$_bin" << EOF
+#!/bin/sh
+exec /opt/$pkgname/usr/bin/$_bin "\$@"
+EOF
+    chmod 755 "$pkgdir/usr/bin/$_bin"
+  done
+
+  install -Dm644 "$_root/usr/share/applications/chiaking.desktop" \
+    "$pkgdir/usr/share/applications/chiaking.desktop"
+  install -Dm644 "$_root/usr/share/metainfo/io.github.streetpea.Chiaki4deck.appdata.xml" \
+    "$pkgdir/usr/share/metainfo/io.github.streetpea.Chiaki4deck.appdata.xml"
+  install -Dm644 "$_root/usr/share/icons/hicolor/512x512/apps/chiaking.png" \
+    "$pkgdir/usr/share/icons/hicolor/512x512/apps/chiaking.png"
+
+  # AGPL-3.0-only-OpenSSL is not a common license, ship the text
+  install -Dm644 "$srcdir/COPYING-${pkgver}" \
+    "$pkgdir/usr/share/licenses/$pkgname/COPYING"
+}

chiaki-ng-bin/pkg.sh

@@ -0,0 +1,26 @@
+# chiaki-ng-bin - chiaki-ng (https://github.com/streetpea/chiaki-ng), a free
+# PlayStation Remote Play client (C/C++ + Qt6).
+#
+# Upstream publishes an AppImage per release, which the PKGBUILD unpacks and
+# installs into /opt - so there is no build step here, only pkgver and the
+# checksums are refreshed on a new version. The license texts are not part of
+# the AppImage and come from the matching source tag.
+
+UPSTREAM_REPO="streetpea/chiaki-ng"
+
+latest_version() {
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' | sed 's/^v//'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local sha_img sha_lic
+
+  sha_img="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/v$ver/chiaki-ng.AppImage_x86_64" \
+    | sha256sum | cut -d' ' -f1)"
+  sha_lic="$(curl -sfL "https://raw.githubusercontent.com/$UPSTREAM_REPO/v$ver/COPYING" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i "s|^sha256sums=.*|sha256sums=('$sha_img' '$sha_lic')|" "$pkgbuild"
+}

chromium-widevine-helper/.SRCINFO

@@ -0,0 +1,25 @@
+pkgbase = chromium-widevine-helper
+	pkgdesc = Extension + native helper that installs Google's Widevine CDM into Chromium-based browser profiles
+	pkgver = 1.0.9
+	pkgrel = 1
+	url = https://github.com/GloriousEggroll/chromium-widevine-helper
+	arch = any
+	license = GPL-3.0-only
+	depends = python
+	depends = procps-ng
+	depends = ca-certificates
+	backup = etc/helium/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/net.imput.helium/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/chromium/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/chromium-browser/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/opt/chrome/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/opt/edge/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/brave/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/vivaldi/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/opera/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/thorium/native-messaging-hosts/org.chromium.widevine.json
+	backup = etc/iridium/native-messaging-hosts/org.chromium.widevine.json
+	source = chromium-widevine-helper-1.0.9.tar.gz::https://github.com/GloriousEggroll/chromium-widevine-helper/archive/586b42ceb035f3202a2d23ee156ecd987567ba2f.tar.gz
+	sha256sums = ae59742c78f0942599d1bfcd5e067f113c11bbc049a31d1b3a6dab9ab45ecb63
+
+pkgname = chromium-widevine-helper

chromium-widevine-helper/PKGBUILD

@@ -0,0 +1,73 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=chromium-widevine-helper
+pkgver=1.0.9
+pkgrel=1
+pkgdesc="Extension + native helper that installs Google's Widevine CDM into Chromium-based browser profiles"
+arch=('any')
+url="https://github.com/GloriousEggroll/chromium-widevine-helper"
+license=('GPL-3.0-only')
+depends=('python' 'procps-ng' 'ca-certificates')
+backup=('etc/helium/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/net.imput.helium/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/chromium/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/chromium-browser/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/opt/chrome/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/opt/edge/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/brave/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/vivaldi/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/opera/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/thorium/native-messaging-hosts/org.chromium.widevine.json'
+        'etc/iridium/native-messaging-hosts/org.chromium.widevine.json')
+# Upstream publishes neither releases nor tags; the canonical version lives in
+# %global helper_version in Packaging/rpm/chromium-widevine-helper.spec. The
+# package is pinned to the commit that carries the packaged version, so it is
+# tied to a specific version and needs no -git suffix.
+_commit="586b42ceb035f3202a2d23ee156ecd987567ba2f"
+source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/${_commit}.tar.gz")
+sha256sums=('ae59742c78f0942599d1bfcd5e067f113c11bbc049a31d1b3a6dab9ab45ecb63')
+
+prepare() {
+  local _specver
+  _specver="$(grep -Po '^%global helper_version \K[0-9.]+' \
+    "${pkgname}-${_commit}/Packaging/rpm/chromium-widevine-helper.spec")"
+  [[ "$_specver" == "$pkgver" ]] || {
+    echo "pinned commit declares $_specver, expected $pkgver" >&2
+    return 1
+  }
+}
+
+package() {
+  cd "${pkgname}-${_commit}"
+
+  # Fedora's /usr/libexec, which Arch does not use
+  install -Dm755 helper/chromium-widevine \
+    "$pkgdir/usr/lib/chromium-widevine/chromium-widevine"
+  install -d "$pkgdir/usr/bin"
+  ln -s /usr/lib/chromium-widevine/chromium-widevine \
+    "$pkgdir/usr/bin/chromium-widevine"
+
+  # The extension is shipped so it can be loaded unpacked from
+  # chrome://extensions (chromium-widevine --install-native-hosts then
+  # registers whatever ID the browser assigned it).
+  install -d "$pkgdir/usr/share/chromium-widevine"
+  cp -a extension "$pkgdir/usr/share/chromium-widevine/extension"
+  find "$pkgdir/usr/share/chromium-widevine" -type d -exec chmod 755 {} +
+  find "$pkgdir/usr/share/chromium-widevine" -type f -exec chmod 644 {} +
+
+  # upstream ships no license file; GPL-3.0-only is a common license
+  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
+
+  # System-wide native messaging host manifests for the same browser lookup
+  # roots upstream's RPM covers.
+  local _hostdir
+  for _hostdir in helium net.imput.helium chromium chromium-browser \
+                  opt/chrome opt/edge brave vivaldi opera thorium iridium; do
+    install -Dm644 helper/chromium-widevine-native-host.json \
+      "$pkgdir/etc/$_hostdir/native-messaging-hosts/org.chromium.widevine.json"
+  done
+  find "$pkgdir/etc" -name 'org.chromium.widevine.json' -exec \
+    sed -i 's|/usr/libexec/chromium-widevine/|/usr/lib/chromium-widevine/|' {} +
+}

chromium-widevine-helper/pkg.sh

@@ -0,0 +1,49 @@
+# chromium-widevine-helper - Chromium extension + native messaging helper
+# that installs Google's Widevine CDM into Chromium-based browser profiles
+# (https://github.com/GloriousEggroll/chromium-widevine-helper).
+#
+# Upstream publishes neither releases nor tags; the canonical version lives in
+# the Fedora RPM spec on the main branch. The package pins the main commit
+# that carries that version, so it stays tied to a specific version (no -git
+# suffix) - refresh_checksums() moves the pin along with the version.
+#
+# Nothing is compiled: the payload is a Python script, JSON manifests and the
+# extension assets, so package() alone does the work.
+
+UPSTREAM_REPO="GloriousEggroll/chromium-widevine-helper"
+SPEC_PATH="Packaging/rpm/chromium-widevine-helper.spec"
+
+BUILD_DEPS=()
+
+spec_version() {
+  grep -Po '^%global helper_version \K[0-9.]+'
+}
+
+latest_version() {
+  curl -sf "https://raw.githubusercontent.com/$UPSTREAM_REPO/main/$SPEC_PATH" \
+    | spec_version
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local commit specver sha
+
+  commit="$(gh api "repos/$UPSTREAM_REPO/commits/main" --jq '.sha')"
+
+  # main may have moved between the version check and this lookup
+  specver="$(curl -sf "https://raw.githubusercontent.com/$UPSTREAM_REPO/$commit/$SPEC_PATH" \
+    | spec_version)"
+  if [[ "$specver" != "$ver" ]]; then
+    echo "main is at $specver, not the requested $ver - try again" >&2
+    return 1
+  fi
+
+  sha="$(curl -sfL "https://github.com/$UPSTREAM_REPO/archive/$commit.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i \
+    -e "s|^_commit=.*|_commit=\"$commit\"|" \
+    -e "s|^sha256sums=.*|sha256sums=('$sha')|" \
+    "$pkgbuild"
+}

concat-bin/.SRCINFO

@@ -0,0 +1,36 @@
+pkgbase = concat-bin
+	pkgdesc = Free and open-source CapCut replacement, a video editor with a Rust engine (upstream binary)
+	pkgver = 0.2.5
+	pkgrel = 1
+	url = https://github.com/jub0t/Concat
+	arch = x86_64
+	arch = aarch64
+	license = AGPL-3.0-or-later
+	license = GPL-3.0-or-later
+	depends = alsa-lib
+	depends = fontconfig
+	depends = freetype2
+	depends = libglvnd
+	depends = libxkbcommon
+	depends = libxkbcommon-x11
+	depends = libx11
+	depends = libxcursor
+	depends = libxi
+	depends = libxrender
+	depends = wayland
+	depends = dbus
+	depends = gcc-libs
+	depends = glibc
+	depends = hicolor-icon-theme
+	provides = concat
+	conflicts = concat
+	noextract = concat-bin-0.2.5-x86_64.deb
+	noextract = concat-bin-0.2.5-aarch64.deb
+	options = !strip
+	options = !debug
+	source_x86_64 = concat-bin-0.2.5-x86_64.deb::https://github.com/jub0t/Concat/releases/download/v0.2.5/Concat-0.2.5-linux-x86_64.deb
+	sha256sums_x86_64 = e93817f911d8e581645786c52ddbadde16abe715b3c3c7a2550ce042313d2828
+	source_aarch64 = concat-bin-0.2.5-aarch64.deb::https://github.com/jub0t/Concat/releases/download/v0.2.5/Concat-0.2.5-linux-aarch64.deb
+	sha256sums_aarch64 = 38e23c6629740cebc24051d92eb4d2475ac9fe58b35eed70653f9c14546926b8
+
+pkgname = concat-bin

concat-bin/PKGBUILD

@@ -0,0 +1,64 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=concat-bin
+pkgver=0.2.5
+pkgrel=1
+pkgdesc="Free and open-source CapCut replacement, a video editor with a Rust engine (upstream binary)"
+arch=('x86_64' 'aarch64')
+url="https://github.com/jub0t/Concat"
+# The binary is Concat under the AGPL; the FFmpeg libraries it ships beside
+# itself are a GPL build. Both licence texts land in the package: the
+# repository's LICENSE, and upstream's notices file, which is what names the
+# terms of everything linked in - FFmpeg, Slint under its GPL option,
+# whisper.cpp, sherpa-onnx.
+license=('AGPL-3.0-or-later' 'GPL-3.0-or-later')
+# Nothing is spawned at run time: FFmpeg is linked, whisper.cpp and
+# sherpa-onnx are compiled in, and ONNX Runtime ships in the same lib/
+# directory. What is left is what the binary loads by name - the ALSA backend
+# of cpal, fontconfig and freetype for text, and the windowing libraries
+# winit and the renderer open: EGL, Wayland, X11 and xkbcommon. dbus is the
+# XDG portal, which is how the file dialogs and "reveal in file manager" work
+# without a toolkit.
+depends=('alsa-lib' 'fontconfig' 'freetype2' 'libglvnd' 'libxkbcommon'
+         'libxkbcommon-x11' 'libx11' 'libxcursor' 'libxi' 'libxrender'
+         'wayland' 'dbus' 'gcc-libs' 'glibc' 'hicolor-icon-theme')
+provides=('concat')
+conflicts=('concat')
+# !strip: upstream's binary is already stripped, and the FFmpeg and ONNX
+# Runtime libraries beside it are theirs to ship as they are.
+options=('!strip' '!debug')
+# Upstream's Linux packages carry one self-contained folder: the binary and
+# the libraries it was linked against - FFmpeg 8 (Arch is on 9) and ONNX
+# Runtime, the cutout models' runtime. They go to /opt/concat, where the
+# binary's own rpath ($ORIGIN/lib) finds them, which is also where upstream's
+# .deb puts them and what its desktop entry points at.
+#
+# Of the three Linux artifacts - .deb, .rpm and AppImage - the .deb is the
+# plain one: an ar archive around that folder, with no runtime wrapped around
+# it and nothing to mount.
+#
+# The asset name carries the workspace's version, not the tag (a prerelease of
+# 0.2.4 ships Concat-0.2.4-linux-x86_64.deb whatever its tag says), so both
+# the tag and that version are resolved through the release manifest and
+# synced here along with the checksums; see pkg.sh.
+_tag="v0.2.5"
+_relver="0.2.5"
+source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::https://github.com/jub0t/Concat/releases/download/${_tag}/Concat-${_relver}-linux-x86_64.deb")
+source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::https://github.com/jub0t/Concat/releases/download/${_tag}/Concat-${_relver}-linux-aarch64.deb")
+noextract=("${pkgname}-${pkgver}-x86_64.deb" "${pkgname}-${pkgver}-aarch64.deb")
+sha256sums_x86_64=('e93817f911d8e581645786c52ddbadde16abe715b3c3c7a2550ce042313d2828')
+sha256sums_aarch64=('38e23c6629740cebc24051d92eb4d2475ac9fe58b35eed70653f9c14546926b8')
+
+package() {
+  # -p: lib/ is the usual set of soname symlinks beside the real files, and
+  # only an extraction that preserves them keeps the rpath working.
+  bsdtar -xOf "$srcdir/${pkgname}-${pkgver}-${CARCH}.deb" 'data.tar.*' \
+    | bsdtar -xpf - -C "$pkgdir" ./opt ./usr
+
+  # upstream ships them as documentation; on Arch they belong here
+  install -d "$pkgdir/usr/share/licenses"
+  mv "$pkgdir/usr/share/doc/concat" "$pkgdir/usr/share/licenses/$pkgname"
+  rmdir "$pkgdir/usr/share/doc"
+}

concat-bin/pkg.sh

@@ -0,0 +1,84 @@
+# concat-bin - Concat (https://github.com/jub0t/Concat), a free and
+# open-source CapCut replacement.
+#
+# Upstream builds the Linux release itself, so there is no build step here:
+# on a new version the tag, the asset version and the checksums are refreshed
+# and the PKGBUILD repackages upstream's .deb.
+#
+# 0.2.3 replaced the self-contained tarball this package used to take with a
+# .deb, an .rpm and an AppImage, each for x86_64 and aarch64. Every release
+# also carries a manifest.json listing each artifact with its sha256, so a
+# new version costs two API calls and no download.
+#
+# The release list is not ordered by version: GitHub sorts it by creation
+# time, and upstream's alpha numbering has run out of step with it before
+# (v0.2.0-alpha.10 sat between alpha.2 and alpha.1). The newest release is
+# therefore picked by publication date rather than by list position. Only
+# tags that start with a version are considered, which is also what keeps the
+# rolling "nightly" prerelease out.
+#
+# The asset name carries the workspace's version, not the tag - a prerelease
+# of 0.2.4 ships Concat-0.2.4-linux-x86_64.deb whatever its tag says - so it
+# cannot be derived from pkgver and is read from the manifest into _relver.
+#
+# pkgver drops the hyphens from the tag (v0.2.4-alpha.1 -> 0.2.4alpha.1).
+# pacman sorts that older than a later plain 0.2.4 (`vercmp 0.2.4alpha.1
+# 0.2.4` is -1), so prereleases upgrade to the eventual release on their own
+# and no epoch is needed.
+
+UPSTREAM_REPO="jub0t/Concat"
+
+# newest published release whose tag looks like a version
+latest_tag() {
+  gh api "repos/$UPSTREAM_REPO/releases?per_page=100" \
+    --jq '[.[] | select(.draft | not) | select(.tag_name | test("^v[0-9]"))]
+          | sort_by(.published_at) | last | .tag_name'
+}
+
+tag_to_pkgver() {
+  sed 's/^v//; s/-//g'
+}
+
+latest_version() {
+  latest_tag | tag_to_pkgver
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local tag manifest relver sha_x86_64 sha_aarch64 arch sha file
+
+  tag="$(latest_tag)"
+  if [[ "$(tag_to_pkgver <<< "$tag")" != "$ver" ]]; then
+    echo "newest versioned release is $tag, not the requested $ver - try again" >&2
+    return 1
+  fi
+
+  manifest="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/$tag/manifest.json")"
+  relver="$(jq -r '.version // empty' <<< "$manifest" 2>/dev/null)"
+  if [[ -z "$relver" ]]; then
+    echo "$tag carries no usable manifest.json" >&2
+    return 1
+  fi
+
+  # Both the name and the checksum come from the manifest, and the name is
+  # checked against what the PKGBUILD builds from _relver: a release that
+  # renames its artifacts says so here instead of 404ing in the test build.
+  for arch in x86_64 aarch64; do
+    sha="$(jq -r --arg a "$arch" '.binaries.linux[$a].deb.sha256 // empty' <<< "$manifest")"
+    file="$(jq -r --arg a "$arch" '.binaries.linux[$a].deb.file // empty' <<< "$manifest")"
+    if [[ ! "$sha" =~ ^[0-9a-f]{64}$ || "$file" != "Concat-$relver-linux-$arch.deb" ]]; then
+      echo "$tag's manifest lists no Concat-$relver-linux-$arch.deb with a sha256" \
+           "(file: ${file:-none})" >&2
+      return 1
+    fi
+    printf -v "sha_$arch" '%s' "$sha"
+  done
+
+  sed -i \
+    -e "s|^_tag=.*|_tag=\"$tag\"|" \
+    -e "s|^_relver=.*|_relver=\"$relver\"|" \
+    -e "s|^sha256sums_x86_64=.*|sha256sums_x86_64=('$sha_x86_64')|" \
+    -e "s|^sha256sums_aarch64=.*|sha256sums_aarch64=('$sha_aarch64')|" \
+    "$pkgbuild"
+}

concat-git/.SRCINFO

@@ -0,0 +1,38 @@
+pkgbase = concat-git
+	pkgdesc = Free and open-source CapCut replacement, a video editor with a Rust engine (git)
+	pkgver = 0.2.1.r12.geef4579
+	pkgrel = 1
+	url = https://github.com/jub0t/Concat
+	arch = x86_64
+	license = AGPL-3.0-or-later
+	makedepends = rust
+	makedepends = cmake
+	makedepends = clang
+	makedepends = pkgconf
+	makedepends = git
+	depends = ffmpeg
+	depends = onnxruntime
+	depends = alsa-lib
+	depends = fontconfig
+	depends = freetype2
+	depends = libglvnd
+	depends = vulkan-icd-loader
+	depends = libxkbcommon
+	depends = libxkbcommon-x11
+	depends = libx11
+	depends = libxcursor
+	depends = libxi
+	depends = libxrender
+	depends = wayland
+	depends = dbus
+	depends = gcc-libs
+	depends = glibc
+	depends = hicolor-icon-theme
+	provides = concat
+	conflicts = concat
+	options = !debug
+	options = !lto
+	source = concat-git::git+https://github.com/jub0t/Concat.git
+	sha256sums = SKIP
+
+pkgname = concat-git

concat-git/PKGBUILD

@@ -0,0 +1,114 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=concat-git
+pkgver=0.2.1.r12.geef4579
+pkgrel=1
+pkgdesc="Free and open-source CapCut replacement, a video editor with a Rust engine (git)"
+arch=('x86_64')
+url="https://github.com/jub0t/Concat"
+license=('AGPL-3.0-or-later')
+# Nothing is spawned at run time: FFmpeg is linked, whisper.cpp and
+# sherpa-onnx are compiled in. alsa-lib is cpal's playback backend;
+# fontconfig and freetype are the font side of the renderer; libglvnd and
+# vulkan-icd-loader are the two backends wgpu picks between, and the rest is
+# what winit opens by name for whichever session the user is in. dbus is the
+# XDG portal, which is how the file dialogs and "reveal in file manager"
+# work without a toolkit. onnxruntime runs the cutout models and is linked
+# dynamically, see ORT_LIB_LOCATION in build().
+depends=('ffmpeg' 'onnxruntime' 'alsa-lib' 'fontconfig' 'freetype2'
+         'libglvnd' 'vulkan-icd-loader' 'libxkbcommon' 'libxkbcommon-x11'
+         'libx11' 'libxcursor' 'libxi' 'libxrender' 'wayland' 'dbus'
+         'gcc-libs' 'glibc' 'hicolor-icon-theme')
+# clang: bindgen (FFmpeg headers, whisper.cpp) needs libclang.
+# cmake: whisper.cpp is compiled in, by its own CMake build.
+makedepends=('rust' 'cmake' 'clang' 'pkgconf' 'git')
+provides=('concat')
+conflicts=('concat')
+# !debug: the app profile strips symbols itself, so there is nothing left to
+# split into a debug package.
+# !lto: makepkg's lto puts -flto=auto into CFLAGS, and ring - the crypto
+# behind the model downloads' TLS - compiles hand-written assembly through
+# cc, which comes out as bitcode and links to nothing. Rust's own LTO is set
+# in the app profile and is unaffected.
+options=('!debug' '!lto')
+source=("${pkgname}::git+https://github.com/jub0t/Concat.git")
+sha256sums=('SKIP')
+
+pkgver() {
+  cd "$pkgname"
+  git describe --long --abbrev=7 --tags --match 'v[0-9]*' \
+    | sed 's/^v//; s/\([^-]*-g\)/r\1/; s/-/./g'
+}
+
+prepare() {
+  cd "$pkgname/src"
+
+  export RUSTUP_TOOLCHAIN=stable
+  cargo fetch --locked --target "$(rustc -vV | sed -n 's/^host: //p')"
+}
+
+build() {
+  cd "$pkgname/src"
+
+  export RUSTUP_TOOLCHAIN=stable
+  export CARGO_TARGET_DIR=target
+  # ort, the ONNX Runtime binding behind the cutout models, downloads a
+  # prebuilt runtime from its build script unless it is pointed at one. Arch
+  # has the library, so it is linked against that instead - dynamically, so
+  # the package follows onnxruntime's updates rather than freezing a copy.
+  # Upstream's flake.nix does the same with nixpkgs' onnxruntime.
+  export ORT_LIB_LOCATION=/usr/lib
+  export ORT_PREFER_DYNAMIC_LINK=1
+  # and if that ever stops being picked up, fail the build instead of
+  # quietly falling back to the download
+  export ORT_SKIP_DOWNLOAD=1
+  # ggml (whisper.cpp's kernels) tunes itself to the machine it is compiled
+  # on unless told otherwise. A package is not always built on the machine it
+  # runs on, and a binary that faults on a CPU without AVX-512 is a bad trade
+  # for kernels nobody measured. Off, it compiles to the portable baseline.
+  export GGML_NATIVE=OFF
+
+  # --profile app: upstream's shipping profile - fat LTO, panic=abort,
+  # stripped. See src/Cargo.toml for what each knob is for.
+  #
+  # Two build scripts download prebuilt static libraries from their own
+  # release pages: sherpa-onnx-sys (text to speech) and skia-bindings (Skia,
+  # the window's renderer; main dropped the FemtoVG-over-wgpu option after
+  # 0.2.4). Their versions move with main, so they are not pinned as sources
+  # here, and build() needs the network.
+  cargo build --profile app -p concat --frozen
+}
+
+package() {
+  cd "$pkgname"
+
+  install -Dm755 "src/target/app/concat" "$pkgdir/usr/bin/concat"
+
+  # The desktop entry upstream's release workflow writes into its Linux
+  # packages; there is none in the tree, because the Nix build generates its
+  # own. Reproduced here, with the Exec line pointing at this package's
+  # binary rather than at the /opt folder upstream's .deb installs.
+  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/concat.desktop" <<'EOF'
+[Desktop Entry]
+Type=Application
+Name=Concat
+Comment=Video editor
+Exec=concat %U
+Icon=concat
+Categories=AudioVideo;Video;
+Terminal=false
+EOF
+
+  install -Dm644 "assets/icons/concat_logo_256.png" \
+    "$pkgdir/usr/share/icons/hicolor/256x256/apps/concat.png"
+  install -Dm644 "assets/concat_logo_512.png" \
+    "$pkgdir/usr/share/icons/hicolor/512x512/apps/concat.png"
+
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 LICENSE-EXCEPTIONS.md \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE-EXCEPTIONS.md"
+  install -Dm644 THIRD_PARTY_NOTICES.md \
+    "$pkgdir/usr/share/licenses/$pkgname/THIRD_PARTY_NOTICES.md"
+}

concat-git/pkg.sh

@@ -0,0 +1,35 @@
+# concat-git - Concat (https://github.com/jub0t/Concat) built from the main
+# branch. Same build as concat, see that package for why the editor needs
+# cargo, cmake and clang.
+#
+# The differences: main dropped the FemtoVG-over-wgpu renderer after 0.2.4,
+# so this builds upstream's default, Skia. And concat pins the prebuilt
+# sherpa-onnx static-lib archive as a checksummed source, which it can
+# because the version comes from a tagged Cargo.lock. Here the versions move
+# with main, so the build scripts of sherpa-onnx-sys and skia-bindings
+# download their archives and build() needs the network.
+#
+# VCS packages are not version-tracked here on purpose. The AUR copy of a -git
+# PKGBUILD carries only a snapshot of pkgver; the real version comes from
+# pkgver() when the user builds it. Following main here would mean AUR pushes
+# that change nothing for anyone. latest_version() therefore reports the
+# pkgver that is already in the PKGBUILD, which makes the update run a no-op:
+# the package is rebuilt, re-checked and pushed only when the packaging
+# itself changes.
+#
+# When that happens, makepkg refreshes the pkgver snapshot in the PKGBUILD as
+# part of the test build, so the committed snapshot follows along by itself.
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(rust cmake clang pkgconf git ffmpeg onnxruntime-cpu alsa-lib fontconfig freetype2)
+
+latest_version() {
+  grep -Po '^pkgver=\K.*' "$(dirname "${BASH_SOURCE[0]}")/PKGBUILD"
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+# Unreachable: latest_version() never reports a version other than the current
+# one. The git source carries SKIP checksums, so there would be nothing to do.
+refresh_checksums() {
+  :
+}

concat/.SRCINFO

@@ -0,0 +1,41 @@
+pkgbase = concat
+	pkgdesc = Free and open-source CapCut replacement, a video editor with a Rust engine
+	pkgver = 0.2.5
+	pkgrel = 1
+	url = https://github.com/jub0t/Concat
+	arch = x86_64
+	license = AGPL-3.0-or-later
+	makedepends = rust
+	makedepends = cmake
+	makedepends = clang
+	makedepends = pkgconf
+	depends = ffmpeg
+	depends = onnxruntime
+	depends = alsa-lib
+	depends = fontconfig
+	depends = freetype2
+	depends = libglvnd
+	depends = vulkan-icd-loader
+	depends = libxkbcommon
+	depends = libxkbcommon-x11
+	depends = libx11
+	depends = libxcursor
+	depends = libxi
+	depends = libxrender
+	depends = wayland
+	depends = dbus
+	depends = gcc-libs
+	depends = glibc
+	depends = hicolor-icon-theme
+	noextract = sherpa-onnx-v1.13.7-linux-x64-static-lib.tar.bz2
+	noextract = skia-binaries-b7f043e0b1e2a850e702-x86_64-unknown-linux-gnu-ganesh-gl-jpegd-jpege-pdf-vulkan.tar.gz
+	options = !debug
+	options = !lto
+	source = concat-0.2.5.tar.gz::https://github.com/jub0t/Concat/archive/refs/tags/v0.2.5.tar.gz
+	source = https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.13.7/sherpa-onnx-v1.13.7-linux-x64-static-lib.tar.bz2
+	source = https://github.com/rust-skia/skia-binaries/releases/download/0.153.3/skia-binaries-b7f043e0b1e2a850e702-x86_64-unknown-linux-gnu-ganesh-gl-jpegd-jpege-pdf-vulkan.tar.gz
+	sha256sums = f77a4e7751f2dc60fa69829434cb2981243736dc98ebd269ba6bd1a75113b9ce
+	sha256sums = d1be7a69ac2b30120058d8302e624239a3064085383cfa47994a14fdc44c32d6
+	sha256sums = 9ebe4c448cc9f789bad241cbd11739cdf759e27db5719c23a7635e096d5807b3
+
+pkgname = concat

concat/PKGBUILD

@@ -0,0 +1,126 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=concat
+pkgver=0.2.5
+pkgrel=1
+pkgdesc="Free and open-source CapCut replacement, a video editor with a Rust engine"
+arch=('x86_64')
+url="https://github.com/jub0t/Concat"
+license=('AGPL-3.0-or-later')
+# Nothing is spawned at run time: FFmpeg is linked, whisper.cpp, sherpa-onnx
+# and Skia are compiled in. alsa-lib is cpal's playback backend;
+# fontconfig and freetype are the font side of the renderer; libglvnd and
+# vulkan-icd-loader are the two backends Skia and wgpu draw on, and the rest is
+# what winit opens by name for whichever session the user is in. dbus is the
+# XDG portal, which is how the file dialogs and "reveal in file manager"
+# work without a toolkit. onnxruntime runs the cutout models and is linked
+# dynamically, see ORT_LIB_LOCATION in build().
+depends=('ffmpeg' 'onnxruntime' 'alsa-lib' 'fontconfig' 'freetype2'
+         'libglvnd' 'vulkan-icd-loader' 'libxkbcommon' 'libxkbcommon-x11'
+         'libx11' 'libxcursor' 'libxi' 'libxrender' 'wayland' 'dbus'
+         'gcc-libs' 'glibc' 'hicolor-icon-theme')
+# clang: bindgen (FFmpeg headers, whisper.cpp) needs libclang.
+# cmake: whisper.cpp is compiled in, by its own CMake build.
+makedepends=('rust' 'cmake' 'clang' 'pkgconf')
+# !debug: the app profile strips symbols itself, so there is nothing left to
+# split into a debug package.
+# !lto: makepkg's lto puts -flto=auto into CFLAGS, and ring - the crypto
+# behind the model downloads' TLS - compiles hand-written assembly through
+# cc, which comes out as bitcode and links to nothing. Rust's own LTO is set
+# in the app profile and is unaffected.
+options=('!debug' '!lto')
+# Only tags that start with a version are packaged, and pkgver drops their
+# hyphens (v0.2.2-alpha.1 -> 0.2.2alpha.1), which pacman sorts older than a
+# later plain 0.2.2, so no epoch is needed. See pkg.sh.
+_tag="v0.2.5"
+# sherpa-onnx-sys (the text-to-speech backend) does not build its C++ side:
+# it downloads a prebuilt static-lib archive from its own release page unless
+# it is handed one. Handing it one keeps that binary under makepkg's
+# checksums instead of arriving unverified from a build script. The version
+# follows upstream's Cargo.lock and is synced by pkg.sh.
+_sherpa="1.13.7"
+# skia-bindings, behind Slint's Skia renderer, is the same: it downloads
+# prebuilt Skia libraries unless it is handed them. The archive is named by
+# the crate version and a key (rust-skia commit, target, Skia features). Both
+# are synced by pkg.sh.
+_skia="0.153.3"
+_skia_key="b7f043e0b1e2a850e702-x86_64-unknown-linux-gnu-ganesh-gl-jpegd-jpege-pdf-vulkan"
+source=("${pkgname}-${pkgver}.tar.gz::https://github.com/jub0t/Concat/archive/refs/tags/${_tag}.tar.gz"
+        "https://github.com/k2-fsa/sherpa-onnx/releases/download/v${_sherpa}/sherpa-onnx-v${_sherpa}-linux-x64-static-lib.tar.bz2"
+        "https://github.com/rust-skia/skia-binaries/releases/download/${_skia}/skia-binaries-${_skia_key}.tar.gz")
+noextract=("sherpa-onnx-v${_sherpa}-linux-x64-static-lib.tar.bz2"
+           "skia-binaries-${_skia_key}.tar.gz")
+sha256sums=('f77a4e7751f2dc60fa69829434cb2981243736dc98ebd269ba6bd1a75113b9ce' 'd1be7a69ac2b30120058d8302e624239a3064085383cfa47994a14fdc44c32d6' '9ebe4c448cc9f789bad241cbd11739cdf759e27db5719c23a7635e096d5807b3')
+
+_srcname="Concat-${_tag#v}"
+
+prepare() {
+  cd "$_srcname/src"
+
+  export RUSTUP_TOOLCHAIN=stable
+  cargo fetch --locked --target "$(rustc -vV | sed -n 's/^host: //p')"
+}
+
+build() {
+  cd "$_srcname/src"
+
+  export RUSTUP_TOOLCHAIN=stable
+  export CARGO_TARGET_DIR=target
+  # the checksummed archive from source[1], instead of a download in build()
+  export SHERPA_ONNX_ARCHIVE_DIR="$srcdir"
+  # the same for source[2]; {key} is filled in by skia-bindings itself
+  export SKIA_BINARIES_URL="file://$srcdir/skia-binaries-{key}.tar.gz"
+  # ort, the ONNX Runtime binding behind the cutout models, downloads a
+  # prebuilt runtime from its build script unless it is pointed at one. Arch
+  # has the library, so it is linked against that instead - dynamically, so
+  # the package follows onnxruntime's updates rather than freezing a copy.
+  # Upstream's flake.nix does the same with nixpkgs' onnxruntime.
+  export ORT_LIB_LOCATION=/usr/lib
+  export ORT_PREFER_DYNAMIC_LINK=1
+  # and if that ever stops being picked up, fail the build instead of
+  # quietly falling back to the download
+  export ORT_SKIP_DOWNLOAD=1
+  # ggml (whisper.cpp's kernels) tunes itself to the machine it is compiled
+  # on unless told otherwise. A package is not always built on the machine it
+  # runs on, and a binary that faults on a CPU without AVX-512 is a bad trade
+  # for kernels nobody measured. Off, it compiles to the portable baseline.
+  export GGML_NATIVE=OFF
+
+  # --profile app: upstream's shipping profile - fat LTO, panic=abort,
+  # stripped. See src/Cargo.toml for what each knob is for.
+  cargo build --profile app -p concat --frozen
+}
+
+package() {
+  cd "$_srcname"
+
+  install -Dm755 "src/target/app/concat" "$pkgdir/usr/bin/concat"
+
+  # The desktop entry upstream's release workflow writes into its Linux
+  # packages; there is none in the tree, because the Nix build generates its
+  # own. Reproduced here, with the Exec line pointing at this package's
+  # binary rather than at the /opt folder upstream's .deb installs.
+  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/concat.desktop" <<'EOF'
+[Desktop Entry]
+Type=Application
+Name=Concat
+Comment=Video editor
+Exec=concat %U
+Icon=concat
+Categories=AudioVideo;Video;
+Terminal=false
+EOF
+
+  install -Dm644 "assets/icons/concat_logo_256.png" \
+    "$pkgdir/usr/share/icons/hicolor/256x256/apps/concat.png"
+  install -Dm644 "assets/concat_logo_512.png" \
+    "$pkgdir/usr/share/icons/hicolor/512x512/apps/concat.png"
+
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 LICENSE-EXCEPTIONS.md \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE-EXCEPTIONS.md"
+  install -Dm644 THIRD_PARTY_NOTICES.md \
+    "$pkgdir/usr/share/licenses/$pkgname/THIRD_PARTY_NOTICES.md"
+}

concat/pkg.sh

@@ -0,0 +1,126 @@
+# concat - Concat (https://github.com/jub0t/Concat), a free and open-source
+# CapCut replacement.
+#
+# Source package: the PKGBUILD builds the editor from the release tarball -
+# the same binary upstream ships in the Linux tarball that concat-bin
+# repackages. Upstream's flake.nix is the reference for what that needs, and
+# this follows it: cargo, cmake and clang, the system FFmpeg, and Slint's
+# Skia renderer. (Until 0.2.4 the flake used FemtoVG over wgpu instead; main
+# dropped that option.)
+#
+# Two build scripts download prebuilt static libraries: sherpa-onnx-sys (text
+# to speech) and skia-bindings (Skia). The PKGBUILD lists both archives as
+# sources and points the build scripts at them (SHERPA_ONNX_ARCHIVE_DIR,
+# SKIA_BINARIES_URL), so makepkg checksums them rather than having them
+# fetched unverified mid-build. Their names follow upstream's Cargo.lock, so
+# refresh_checksums() reads them from the tarball and syncs _sherpa, _skia
+# and _skia_key in the PKGBUILD.
+#
+# The Skia archive's key is <rust-skia commit>-<target>-<Skia features>. The
+# commit comes from the skia-bindings crate (.cargo_vcs_info.json). The
+# features depend on what Slint turns on, which only a cargo build resolves,
+# so they are taken from upstream's flake.nix, which has to name the same
+# archive (skiaKeyFeatures). If a flake has none, the PKGBUILD's are kept.
+#
+# Release/version handling is identical to concat-bin: the release list is
+# ordered by creation rather than by version, so the newest is picked by
+# publication date, only tags that start with a version count, and pkgver
+# drops the hyphens - see concat-bin/pkg.sh.
+
+UPSTREAM_REPO="jub0t/Concat"
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(rust cmake clang pkgconf ffmpeg onnxruntime-cpu alsa-lib fontconfig freetype2)
+
+latest_tag() {
+  gh api "repos/$UPSTREAM_REPO/releases?per_page=100" \
+    --jq '[.[] | select(.draft | not) | select(.tag_name | test("^v[0-9]"))]
+          | sort_by(.published_at) | last | .tag_name'
+}
+
+tag_to_pkgver() {
+  sed 's/^v//; s/-//g'
+}
+
+latest_version() {
+  latest_tag | tag_to_pkgver
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local tag tarball lock flake sherpa skia skia_hash skia_features skia_key
+  local sha_src sha_sherpa sha_skia archive
+
+  tag="$(latest_tag)"
+  if [[ "$(tag_to_pkgver <<< "$tag")" != "$ver" ]]; then
+    echo "newest versioned release is $tag, not the requested $ver - try again" >&2
+    return 1
+  fi
+
+  # kept on disk rather than streamed: the tarball is needed for its checksum
+  # and for the Cargo.lock and flake.nix inside it
+  tarball="$(mktemp)"
+  if ! curl -sfL -o "$tarball" \
+       "https://github.com/$UPSTREAM_REPO/archive/refs/tags/$tag.tar.gz"; then
+    rm -f "$tarball"
+    echo "could not download the $tag source tarball" >&2
+    return 1
+  fi
+
+  sha_src="$(sha256sum "$tarball" | cut -d' ' -f1)"
+  # `|| true`, so that a tree that has moved a file or dropped a crate is
+  # reported below instead of ending the run on a failed exit status with
+  # nothing printed.
+  lock="$(tar -xOzf "$tarball" --wildcards '*/src/Cargo.lock' || true)"
+  flake="$(tar -xOzf "$tarball" --wildcards '*/flake.nix' 2>/dev/null || true)"
+  rm -f "$tarball"
+
+  sherpa="$(grep -A2 '^name = "sherpa-onnx-sys"' <<< "$lock" \
+    | sed -n 's/^version = "\(.*\)"/\1/p' || true)"
+  skia="$(grep -A2 '^name = "skia-bindings"' <<< "$lock" \
+    | sed -n 's/^version = "\(.*\)"/\1/p' || true)"
+  if [[ -z "$sherpa" || -z "$skia" ]]; then
+    echo "could not read the sherpa-onnx-sys and skia-bindings versions from $tag's src/Cargo.lock" >&2
+    return 1
+  fi
+
+  skia_hash="$(curl -sfL "https://static.crates.io/crates/skia-bindings/skia-bindings-$skia.crate" \
+    | tar -xzO --wildcards '*/.cargo_vcs_info.json' | jq -r '.git.sha1' | cut -c1-20 || true)"
+  if [[ ! "$skia_hash" =~ ^[0-9a-f]{20}$ ]]; then
+    echo "could not read the rust-skia commit of skia-bindings $skia from crates.io" >&2
+    return 1
+  fi
+  skia_features="$(sed -n 's/^ *skiaKeyFeatures = "\(.*\)";/\1/p' <<< "$flake")"
+  if [[ -z "$skia_features" ]]; then
+    skia_features="$(sed -n 's/^_skia_key=".*-x86_64-unknown-linux-gnu-\(.*\)"/\1/p' "$pkgbuild")"
+  fi
+  skia_key="$skia_hash-x86_64-unknown-linux-gnu-$skia_features"
+
+  archive="$(mktemp)"
+  if ! curl -sfL -o "$archive" \
+       "https://github.com/k2-fsa/sherpa-onnx/releases/download/v$sherpa/sherpa-onnx-v$sherpa-linux-x64-static-lib.tar.bz2"; then
+    rm -f "$archive"
+    echo "could not download the sherpa-onnx $sherpa static-lib archive" >&2
+    return 1
+  fi
+  sha_sherpa="$(sha256sum "$archive" | cut -d' ' -f1)"
+  # a missing archive most likely means the features are wrong: check the
+  # "TRYING TO DOWNLOAD AND INSTALL SKIA BINARIES" line of a build log
+  if ! curl -sfL -o "$archive" \
+       "https://github.com/rust-skia/skia-binaries/releases/download/$skia/skia-binaries-$skia_key.tar.gz"; then
+    rm -f "$archive"
+    echo "rust-skia has no Skia archive $skia/$skia_key" >&2
+    return 1
+  fi
+  sha_skia="$(sha256sum "$archive" | cut -d' ' -f1)"
+  rm -f "$archive"
+
+  sed -i \
+    -e "s|^_tag=.*|_tag=\"$tag\"|" \
+    -e "s|^_sherpa=.*|_sherpa=\"$sherpa\"|" \
+    -e "s|^_skia=.*|_skia=\"$skia\"|" \
+    -e "s|^_skia_key=.*|_skia_key=\"$skia_key\"|" \
+    -e "s|^sha256sums=.*|sha256sums=('$sha_src' '$sha_sherpa' '$sha_skia')|" \
+    "$pkgbuild"
+}

face-unlock-bin/.SRCINFO

@@ -0,0 +1,44 @@
+pkgbase = face-unlock-bin
+	pkgdesc = Face ID for Linux: the lock screen, sudo and admin prompts by face, on Plasma, GNOME, Hyprland and Niri (upstream binary)
+	pkgver = 2.1.0
+	pkgrel = 1
+	url = https://git.felo.gg/LoonixTools/face-unlock
+	install = face-unlock-bin.install
+	arch = x86_64
+	license = GPL-3.0-or-later
+	license = MIT
+	license = Apache-2.0
+	license = BSD-3-Clause
+	license = IJG
+	license = Zlib
+	license = libpng-2.0
+	depends = bash
+	depends = coreutils
+	depends = gawk
+	depends = grep
+	depends = sed
+	depends = gettext
+	depends = systemd
+	depends = systemd-libs
+	depends = pam
+	depends = polkit
+	depends = qt6-base
+	depends = qt6-declarative
+	depends = qt6-wayland
+	depends = wayland
+	depends = layer-shell-qt
+	depends = ki18n
+	depends = glibc
+	depends = libgcc
+	depends = libstdc++
+	depends = hicolor-icon-theme
+	optdepends = hyprpolkitagent: password windows on Hyprland and Niri
+	provides = face-unlock
+	conflicts = face-unlock
+	conflicts = plasma-face-unlock
+	noextract = face-unlock-2.1.0-arch-x86_64.tar.zst
+	options = !debug
+	source = face-unlock-2.1.0-arch-x86_64.tar.zst::https://git.felo.gg/LoonixTools/face-unlock/releases/download/v2.1.0/face-unlock-2.1.0-arch-x86_64.tar.zst
+	sha256sums = b3b48a2c40650cc00ecbde713b86275fe8aef4885ba005c1de6d040974555393
+
+pkgname = face-unlock-bin

face-unlock-bin/PKGBUILD

@@ -0,0 +1,38 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=face-unlock-bin
+pkgver=2.1.0
+pkgrel=1
+pkgdesc="Face ID for Linux: the lock screen, sudo and admin prompts by face, on Plasma, GNOME, Hyprland and Niri (upstream binary)"
+arch=('x86_64')
+url="https://git.felo.gg/LoonixTools/face-unlock"
+# The program is GPL, the two face networks are MIT (YuNet) and Apache-2.0
+# (SFace). The daemon has OpenCV (Apache-2.0) linked in, with its copies of
+# protobuf, libjpeg-turbo, libpng and zlib. All texts are in the package.
+license=('GPL-3.0-or-later' 'MIT' 'Apache-2.0' 'BSD-3-Clause' 'IJG' 'Zlib' 'libpng-2.0')
+# What the binaries load, plus what the face-unlock command runs. No opencv:
+# it is linked in.
+depends=('bash' 'coreutils' 'gawk' 'grep' 'sed' 'gettext' 'systemd' 'systemd-libs' 'pam' 'polkit'
+         'qt6-base' 'qt6-declarative' 'qt6-wayland' 'wayland' 'layer-shell-qt' 'ki18n'
+         'glibc' 'libgcc' 'libstdc++' 'hicolor-icon-theme')
+optdepends=('hyprpolkitagent: password windows on Hyprland and Niri')
+provides=('face-unlock')
+conflicts=('face-unlock' 'plasma-face-unlock')
+install="${pkgname}.install"
+options=('!debug')
+# Upstream's release workflow builds this tarball on Arch: the make install
+# tree of face-unlock, in one folder. The agent uses Qt's private API, so it
+# fits the Qt that Arch had at the release.
+_tarball="face-unlock-${pkgver}-arch-${CARCH}.tar.zst"
+source=("${_tarball}::${url}/releases/download/v${pkgver}/${_tarball}")
+noextract=("${_tarball}")
+sha256sums=('b3b48a2c40650cc00ecbde713b86275fe8aef4885ba005c1de6d040974555393')
+
+package() {
+  # extracted here and not by makepkg, so the files keep the root owner
+  # the tarball gives them
+  bsdtar -xpf "$srcdir/${_tarball}" -C "$pkgdir" --strip-components 1
+  mv "$pkgdir/usr/share/licenses/face-unlock" "$pkgdir/usr/share/licenses/$pkgname"
+}

face-unlock-bin/face-unlock-bin.install

@@ -0,0 +1,34 @@
+post_install() {
+  # Faces, settings and PAM lines of plasma-face-unlock, the old name.
+  face-unlock --root migrate >/dev/null 2>&1 || true
+  cat <<'MSG'
+
+  face-unlock is installed. Run it as your own user, not with sudo:
+
+    face-unlock          interactive menu
+    face-unlock enable   set up your face and turn it on
+
+  It asks for your password when it needs to. sudo and admin prompts stay
+  with the password until you switch them on under Settings.
+
+MSG
+}
+
+post_upgrade() {
+  face-unlock --root migrate >/dev/null 2>&1 || true
+}
+
+pre_remove() {
+  cat <<'MSG'
+
+  Before removing this package, run
+
+    face-unlock disable
+
+  as each user that turned it on. That takes face unlock back out of sudo,
+  polkit and the lock screens. (Removing it without that is safe too: the PAM
+  line is written so that a missing module is skipped.)
+
+MSG
+  systemctl disable --now face-unlockd.socket face-unlockd.service >/dev/null 2>&1 || true
+}

face-unlock-bin/pkg.sh

@@ -0,0 +1,44 @@
+# face-unlock-bin - the Arch build of face-unlock
+# (https://git.felo.gg/LoonixTools/face-unlock), made by upstream's release
+# workflow: the same program as the face-unlock package, with OpenCV linked in
+# statically, so an OpenCV update on Arch does not break it.
+#
+# Not every release has the tarball (2.0.0 and older do not), so the newest
+# release that has it is tracked, not /releases/latest. Gitea keeps no digest
+# for release assets, so the checksum comes from downloading the tarball.
+
+UPSTREAM_REPO="LoonixTools/face-unlock"
+
+# newest published release with an Arch tarball, as its tag
+latest_tag() {
+  curl -sf "https://git.felo.gg/api/v1/repos/$UPSTREAM_REPO/releases?limit=30" \
+    | jq -r '[.[] | select((.draft or .prerelease) | not)
+                  | select(any(.assets[]; .name | endswith("-arch-x86_64.tar.zst")))]
+             | first | .tag_name // empty'
+}
+
+# Kept off the AUR until a release has the tarball: until then the PKGBUILD
+# has nothing to point at. The run that finds the first one updates the
+# PKGBUILD and test-builds it before anything is pushed.
+AUR_PUBLISH=false
+if [[ -n "$(latest_tag)" ]]; then
+  AUR_PUBLISH=true
+fi
+
+latest_version() {
+  local tag
+  tag="$(latest_tag)"
+  [[ -n "$tag" ]] || return 75
+  echo "${tag#v}"
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local name="face-unlock-$ver-arch-x86_64.tar.zst" sha
+
+  sha="$(curl -sfL "https://git.felo.gg/$UPSTREAM_REPO/releases/download/v$ver/$name" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i "s|^sha256sums=.*|sha256sums=('$sha')|" "$pkgbuild"
+}

face-unlock/.SRCINFO

@@ -0,0 +1,41 @@
+pkgbase = face-unlock
+	pkgdesc = Face ID for Linux: the lock screen, sudo and admin prompts by face, on Plasma, GNOME, Hyprland and Niri
+	pkgver = 2.1.0
+	pkgrel = 1
+	url = https://git.felo.gg/LoonixTools/face-unlock
+	install = face-unlock.install
+	arch = x86_64
+	arch = aarch64
+	license = GPL-3.0-or-later
+	license = MIT
+	license = Apache-2.0
+	makedepends = cmake
+	makedepends = scdoc
+	depends = bash
+	depends = coreutils
+	depends = gawk
+	depends = grep
+	depends = sed
+	depends = gettext
+	depends = systemd
+	depends = systemd-libs
+	depends = pam
+	depends = polkit
+	depends = opencv
+	depends = qt6-base
+	depends = qt6-declarative
+	depends = layer-shell-qt
+	depends = ki18n
+	optdepends = hyprpolkitagent: password windows on Hyprland and Niri
+	conflicts = plasma-face-unlock
+	replaces = plasma-face-unlock
+	noextract = face_detection_yunet_2023mar.onnx
+	noextract = face_recognition_sface_2021dec.onnx
+	source = face-unlock-2.1.0.tar.gz::https://git.felo.gg/LoonixTools/face-unlock/archive/v2.1.0.tar.gz
+	source = face_detection_yunet_2023mar.onnx::https://github.com/opencv/opencv_zoo/raw/main/models/face_detection_yunet/face_detection_yunet_2023mar.onnx
+	source = face_recognition_sface_2021dec.onnx::https://github.com/opencv/opencv_zoo/raw/main/models/face_recognition_sface/face_recognition_sface_2021dec.onnx
+	sha256sums = 35ab950c775c92706bd1ea7e5b8abfa99dea7635f8e971dabd80ed6a1afc1270
+	sha256sums = 8f2383e4dd3cfbb4553ea8718107fc0423210dc964f9f4280604804ed2552fa4
+	sha256sums = 0ba9fbfa01b5270c96627c4ef784da859931e02f04419c829e83484087c34e79
+
+pkgname = face-unlock

face-unlock/PKGBUILD

@@ -0,0 +1,37 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=face-unlock
+pkgver=2.1.0
+pkgrel=1
+pkgdesc="Face ID for Linux: the lock screen, sudo and admin prompts by face, on Plasma, GNOME, Hyprland and Niri"
+arch=('x86_64' 'aarch64')
+url="https://git.felo.gg/LoonixTools/face-unlock"
+license=('GPL-3.0-or-later' 'MIT' 'Apache-2.0')
+depends=('bash' 'coreutils' 'gawk' 'grep' 'sed' 'gettext' 'systemd' 'systemd-libs' 'pam' 'polkit'
+         'opencv' 'qt6-base' 'qt6-declarative' 'layer-shell-qt' 'ki18n')
+makedepends=('cmake' 'scdoc')
+optdepends=('hyprpolkitagent: password windows on Hyprland and Niri')
+# The old name.
+replaces=('plasma-face-unlock')
+conflicts=('plasma-face-unlock')
+install="${pkgname}.install"
+# The two face networks come from the OpenCV model zoo, pinned by checksum.
+source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz"
+        "face_detection_yunet_2023mar.onnx::https://github.com/opencv/opencv_zoo/raw/main/models/face_detection_yunet/face_detection_yunet_2023mar.onnx"
+        "face_recognition_sface_2021dec.onnx::https://github.com/opencv/opencv_zoo/raw/main/models/face_recognition_sface/face_recognition_sface_2021dec.onnx")
+noextract=('face_detection_yunet_2023mar.onnx' 'face_recognition_sface_2021dec.onnx')
+sha256sums=('35ab950c775c92706bd1ea7e5b8abfa99dea7635f8e971dabd80ed6a1afc1270' '8f2383e4dd3cfbb4553ea8718107fc0423210dc964f9f4280604804ed2552fa4' '0ba9fbfa01b5270c96627c4ef784da859931e02f04419c829e83484087c34e79')
+
+build() {
+  make -C "${pkgname}" VERSION="$pkgver"
+}
+
+check() {
+  make -C "${pkgname}" VERSION="$pkgver" test
+}
+
+package() {
+  make -C "${pkgname}" VERSION="$pkgver" MODELS_SRC="$srcdir" DESTDIR="$pkgdir" install
+}

face-unlock/face-unlock.install

@@ -0,0 +1,34 @@
+post_install() {
+  # Faces, settings and PAM lines of plasma-face-unlock, the old name.
+  face-unlock --root migrate >/dev/null 2>&1 || true
+  cat <<'MSG'
+
+  face-unlock is installed. Run it as your own user, not with sudo:
+
+    face-unlock          interactive menu
+    face-unlock enable   set up your face and turn it on
+
+  It asks for your password when it needs to. sudo and admin prompts stay
+  with the password until you switch them on under Settings.
+
+MSG
+}
+
+post_upgrade() {
+  face-unlock --root migrate >/dev/null 2>&1 || true
+}
+
+pre_remove() {
+  cat <<'MSG'
+
+  Before removing this package, run
+
+    face-unlock disable
+
+  as each user that turned it on. That takes face unlock back out of sudo,
+  polkit and the lock screens. (Removing it without that is safe too: the PAM
+  line is written so that a missing module is skipped.)
+
+MSG
+  systemctl disable --now face-unlockd.socket face-unlockd.service >/dev/null 2>&1 || true
+}

face-unlock/pkg.sh

@@ -0,0 +1,32 @@
+# face-unlock - Face ID for Linux: Plasma, GNOME, Hyprland and Niri
+# (https://git.felo.gg/LoonixTools/face-unlock). Called plasma-face-unlock
+# before 2.0.0.
+#
+# Built from the release tarball with the upstream Makefile (CMake for the
+# daemon, the agent and the PAM module). The two face networks are sources of
+# their own from the OpenCV model zoo with fixed checksums, so a release only
+# changes the tarball's.
+
+UPSTREAM_REPO="LoonixTools/face-unlock"
+
+# Installed in CI (pacman) before the makepkg test build, which skips the
+# dependency check. check() runs the upstream tests and needs nothing more.
+BUILD_DEPS=(cmake scdoc gettext opencv qt6-base qt6-declarative layer-shell-qt ki18n pam systemd-libs)
+
+latest_version() {
+  # the highest vX.Y.Z tag; not every release has a release page
+  curl -sf "https://git.felo.gg/api/v1/repos/$UPSTREAM_REPO/tags?limit=50" \
+    | jq -r '.[].name | select(test("^v[0-9]+(\\.[0-9]+)*$"))' \
+    | sed 's/^v//' | sort -V | tail -n 1
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local sha
+  sha="$(curl -sfL \
+    "https://git.felo.gg/$UPSTREAM_REPO/archive/v$ver.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+  # Only the first sum is the tarball's; the models' stay.
+  sed -i -E "s|^sha256sums=\('[^']*'|sha256sums=('$sha'|" "$pkgbuild"
+}

faugus-launcher-bin/.SRCINFO

@@ -0,0 +1,28 @@
+pkgbase = faugus-launcher-bin
+	pkgdesc = Simple and lightweight app for running Windows games using UMU-Launcher (upstream binary)
+	pkgver = 2.4.2
+	pkgrel = 1
+	url = https://github.com/Faugus/faugus-launcher
+	arch = any
+	license = MIT
+	depends = gtk4
+	depends = libadwaita
+	depends = libmanette
+	depends = icoextract
+	depends = python
+	depends = python-gobject
+	depends = python-requests
+	depends = python-pillow
+	depends = python-vdf
+	depends = python-psutil
+	depends = python-dbus
+	depends = umu-launcher
+	optdepends = mangohud: performance overlay
+	optdepends = gamemode: feral gamemode integration
+	provides = faugus-launcher
+	conflicts = faugus-launcher
+	noextract = faugus-launcher-bin-2.4.2.deb
+	source = faugus-launcher-bin-2.4.2.deb::https://github.com/Faugus/faugus-launcher/releases/download/2.4.2/faugus-launcher_2.4.2-1_all.deb
+	sha256sums = 06d41869f42c2078a36a366b38ee62b7aa6dc98e08bb4a1346d7eb193ff8f145
+
+pkgname = faugus-launcher-bin

faugus-launcher-bin/PKGBUILD

@@ -0,0 +1,66 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=faugus-launcher-bin
+pkgver=2.4.2
+pkgrel=1
+pkgdesc="Simple and lightweight app for running Windows games using UMU-Launcher (upstream binary)"
+arch=('any')
+url="https://github.com/Faugus/faugus-launcher"
+license=('MIT')
+depends=('gtk4' 'libadwaita' 'libmanette' 'icoextract' 'python'
+         'python-gobject' 'python-requests' 'python-pillow' 'python-vdf'
+         'python-psutil' 'python-dbus' 'umu-launcher')
+optdepends=('mangohud: performance overlay'
+            'gamemode: feral gamemode integration')
+provides=('faugus-launcher')
+conflicts=('faugus-launcher')
+# The Debian revision in the asset name does not follow from pkgver, so the
+# exact name is tracked here and refreshed automatically.
+_asset="faugus-launcher_2.4.2-1_all.deb"
+source=("${pkgname}-${pkgver}.deb::${url}/releases/download/${pkgver}/${_asset}")
+noextract=("${pkgname}-${pkgver}.deb")
+sha256sums=('06d41869f42c2078a36a366b38ee62b7aa6dc98e08bb4a1346d7eb193ff8f145')
+
+package() {
+  local _deb="$srcdir/deb"
+
+  install -d "$_deb"
+  bsdtar -xOf "$srcdir/${pkgname}-${pkgver}.deb" 'data.tar.*' \
+    | bsdtar -xpf - -C "$_deb" ./usr
+
+  # Debian puts the modules in dist-packages, which is not on Arch's
+  # sys.path. A fixed private directory also keeps the package working
+  # across Python minor bumps, since it is only rebuilt for new releases.
+  install -d "$pkgdir/usr/lib/faugus-launcher"
+  cp -a "$_deb/usr/lib/python3/dist-packages/faugus" "$pkgdir/usr/lib/faugus-launcher/"
+  # .pyc compiled for Debian's Python, useless here
+  find "$pkgdir/usr/lib/faugus-launcher" -type d -name __pycache__ -exec rm -rf {} +
+
+  cp -a "$_deb/usr/share" "$pkgdir/usr/"
+  # generated by pacman hooks; shipping them would cause file conflicts
+  rm -f "$pkgdir/usr/share/applications/mimeinfo.cache" \
+        "$pkgdir/usr/share/icons/hicolor/icon-theme.cache"
+
+  # upstream's wrapper relies on Debian's default sys.path, ours points at
+  # the directory above; the rest matches upstream verbatim
+  install -d "$pkgdir/usr/bin"
+  cat > "$pkgdir/usr/bin/faugus-launcher" << 'EOF'
+#!/bin/sh
+
+export PYTHONPATH="/usr/lib/faugus-launcher${PYTHONPATH:+:$PYTHONPATH}"
+export GTK_IM_MODULE="${GTK_IM_MODULE:-simple}"
+
+case "$1" in
+	--shortcut) exec /usr/bin/python3 -m faugus.shortcut "$2";;
+	--game)     exec /usr/bin/python3 -m faugus.runner --game "$2";;
+	--run)      msg="$2"; shift 2; exec /usr/bin/python3 -m faugus.runner "$msg" "$@";;
+	*)          exec /usr/bin/python3 -m faugus.launcher "$@";;
+esac
+EOF
+  chmod 755 "$pkgdir/usr/bin/faugus-launcher"
+
+  mv "$pkgdir/usr/share/licenses/faugus-launcher" \
+     "$pkgdir/usr/share/licenses/$pkgname"
+}

faugus-launcher-bin/pkg.sh

@@ -0,0 +1,34 @@
+# faugus-launcher-bin - Faugus Launcher
+# (https://github.com/Faugus/faugus-launcher), a GTK4 front-end for running
+# Windows games through UMU-Launcher.
+#
+# Upstream publishes an architecture-independent .deb per release, which the
+# PKGBUILD repackages. The Debian revision in the asset name is not derived
+# from the version, so refresh_checksums() resolves the asset via the GitHub
+# API and syncs the _asset variable in the PKGBUILD along with the checksum.
+#
+# Upstream tags carry no "v" prefix.
+
+UPSTREAM_REPO="Faugus/faugus-launcher"
+
+latest_version() {
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' | sed 's/^v//'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local asset sha
+
+  asset="$(gh api "repos/$UPSTREAM_REPO/releases/tags/$ver" --jq '.assets[].name' \
+    | grep -E "^faugus-launcher_${ver}-[0-9]+_all\.deb$")"
+  [[ "$(wc -l <<< "$asset")" -eq 1 ]] || { echo "expected exactly one deb, got: $asset" >&2; return 1; }
+
+  sha="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/$ver/$asset" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i \
+    -e "s|^_asset=.*|_asset=\"$asset\"|" \
+    -e "s|^sha256sums=.*|sha256sums=('$sha')|" \
+    "$pkgbuild"
+}

fluxer-bin/.SRCINFO

@@ -1,6 +1,6 @@
 pkgbase = fluxer-bin
 	pkgdesc = Fluxer Desktop Application
-	pkgver = 0.0.8
+	pkgver = 2026.1004.13532
 	pkgrel = 1
 	url = https://fluxer.app
 	arch = x86_64
@@ -9,12 +9,14 @@ pkgbase = fluxer-bin
 	depends = gtk3
 	depends = nss
 	depends = alsa-lib
+	provides = fluxer
+	conflicts = fluxer
 	options = !strip
 	source = fluxer.desktop
 	sha256sums = 981daa8015b823fef254bb8e79fe6b28f77dda02cdc374796443bd64f5041de1
-	source_x86_64 = fluxer-0.0.8-x64.tar.gz::https://api.fluxer.app/dl/desktop/stable/linux/x64/0.0.8/tar_gz
+	source_x86_64 = fluxer-2026.1004.13532-x64.tar.gz::https://api.fluxer.app/dl/desktop/stable/linux/x64/2026.1004.13532/tar_gz
-	sha256sums_x86_64 = acf6398fa6810720fed85b06c011b324e7db4fec6bf2fc7ad93c2446c3600f2d
+	sha256sums_x86_64 = 976ff888bdb78808ebb6b1d4cc68fd41e020ef95a37e6948d6cd561622875e9e
-	source_aarch64 = fluxer-0.0.8-arm64.tar.gz::https://api.fluxer.app/dl/desktop/stable/linux/arm64/0.0.8/tar_gz
+	source_aarch64 = fluxer-2026.1004.13532-arm64.tar.gz::https://api.fluxer.app/dl/desktop/stable/linux/arm64/2026.1004.13532/tar_gz
-	sha256sums_aarch64 = 77b874a98caf48de5bc4ccf03119f45262fe26fd7be085b57d7b40b1505d0ec8
+	sha256sums_aarch64 = cf61c60506fb3a9f9b389af27407cf893eb3133707a8caa8a0ef55902d629a4a
 
 pkgname = fluxer-bin

fluxer-bin/PKGBUILD

@@ -1,32 +1,39 @@
 # Maintainer: Felitendo
 # Contributor: Cosmo <cptncosmo@gmail.com>
 # This PKGBUILD is updated automatically:
-# https://github.com/Felitendo/PKGBUILDS
+# https://git.felo.gg/Felitendo/PKGBUILDS
 
 pkgname=fluxer-bin
-pkgver=0.0.8
+# Upstream versions are date-based: this is the build of 2026-09-20 at
+# 04:13:03 UTC. They sort above the 0.0.x scheme the package used before.
+pkgver=2026.1004.13532
 pkgrel=1
 pkgdesc="Fluxer Desktop Application"
 arch=('x86_64' 'aarch64')
 url="https://fluxer.app"
 license=('AGPL-3.0-only')
 depends=('gtk3' 'nss' 'alsa-lib')
+# /usr/bin/fluxer is also installed by fluxer-git on the AUR and by the
+# "fluxer" package in upstream's own pacman repository:
+# provides/conflicts makes that an either/or instead of a file conflict
+provides=('fluxer')
+conflicts=('fluxer')
 options=('!strip')
 
 source=("fluxer.desktop")
 sha256sums=('981daa8015b823fef254bb8e79fe6b28f77dda02cdc374796443bd64f5041de1')
 
 source_x86_64=("fluxer-${pkgver}-x64.tar.gz::https://api.fluxer.app/dl/desktop/stable/linux/x64/${pkgver}/tar_gz")
-sha256sums_x86_64=('acf6398fa6810720fed85b06c011b324e7db4fec6bf2fc7ad93c2446c3600f2d')
+sha256sums_x86_64=('976ff888bdb78808ebb6b1d4cc68fd41e020ef95a37e6948d6cd561622875e9e')
 
 source_aarch64=("fluxer-${pkgver}-arm64.tar.gz::https://api.fluxer.app/dl/desktop/stable/linux/arm64/${pkgver}/tar_gz")
-sha256sums_aarch64=('77b874a98caf48de5bc4ccf03119f45262fe26fd7be085b57d7b40b1505d0ec8')
+sha256sums_aarch64=('cf61c60506fb3a9f9b389af27407cf893eb3133707a8caa8a0ef55902d629a4a')
 
 package() {
     local _dir
     case "$CARCH" in
-        x86_64)  _dir="fluxer-stable-${pkgver}-x64" ;;
+        x86_64)  _dir="Fluxer-${pkgver}-linux-x64" ;;
-        aarch64) _dir="fluxer-stable-${pkgver}-arm64" ;;
+        aarch64) _dir="Fluxer-${pkgver}-linux-arm64" ;;
     esac
     # upstream has changed the archive layout before - fall back to a glob
     if [ ! -d "$srcdir/$_dir" ]; then
@@ -47,8 +54,22 @@ package() {
 
     install -Dm644 "$srcdir/fluxer.desktop" "$pkgdir/usr/share/applications/fluxer.desktop"
 
-    if [ -f "$pkgdir/opt/$pkgname/resources/512x512.png" ]; then
+    # The bundle carries a full icon set, named after the size it holds.
-        install -Dm644 "$pkgdir/opt/$pkgname/resources/512x512.png" \
+    # The glob takes those and leaves icon.png and the tray templates, which
-            "$pkgdir/usr/share/icons/hicolor/512x512/apps/fluxer.png"
+    # carry no size, alone.
+    local _icon _size _found=0
+    for _icon in "$srcdir/$_dir"/resources/icons/[0-9]*x[0-9]*.png; do
+        [ -f "$_icon" ] || continue
+        _size="$(basename "$_icon" .png)"
+        install -Dm644 "$_icon" \
+            "$pkgdir/usr/share/icons/hicolor/$_size/apps/fluxer.png"
+        _found=1
+    done
+    # the .desktop entry points at this icon, so a silent miss would ship a
+    # window with no icon at all
+    if [ "$_found" -eq 0 ]; then
+        echo "Error: no icons in $_dir/resources/icons" >&2
+        ls -la "$srcdir/$_dir/resources" >&2
+        return 1
     fi
 }

fluxer-bin/pkg.sh

@@ -3,14 +3,56 @@
 # Upstream hosts versioned prebuilt binaries itself, so there is no
 # build_artifact() here: on a new version only pkgver and the checksums
 # are refreshed and the result is pushed to the AUR.
+#
+# Versions are date-based: 2026.920.41303 is the build published at
+# 2026-09-20 04:13:03 UTC, the last field being the time of day without
+# leading zeros. vercmp orders those correctly both within a day and across
+# days, and every one of them outranks the 0.0.x versions this package
+# carried until upstream changed schemes.
+#
+# The download API has one URL shape per channel, and this package follows
+# "stable". Every build publishes a JSON manifest and a .sha256 next to its
+# artifacts, so neither the version check nor the checksum refresh has to
+# pull the ~130 MB tarballs to look at them.
+#
+# Upstream keeps only its last few builds per channel - everything under the
+# old scheme is already gone, which is how a pinned 0.0.8 turned into a 404
+# for anyone installing from the AUR. The version named here stays fetchable
+# only while this repository keeps pace with the channel.
 
 DL_BASE="https://api.fluxer.app/dl/desktop/stable/linux"
 
 latest_version() {
-  # the download API exposes the current version in the attachment filename,
+  local json ver url
-  # e.g. content-disposition: attachment; filename="fluxer-stable-0.0.8-x64.tar.gz"
+
-  curl -sfI "$DL_BASE/x64/latest/tar_gz" \
+  # the channel's manifest for whatever it currently considers current
-    | grep -oiP 'filename="fluxer-(stable-)?\K[0-9][^"]*(?=-x64\.tar\.gz)'
+  json="$(curl -sfL "$DL_BASE/x64/latest")" || return 1
+  ver="$(jq -r '.version // empty' <<< "$json")"
+  url="$(jq -r '.files.tar_gz.url // empty' <<< "$json")"
+
+  # When stable has no current build the API falls through to another
+  # channel, and the artifact URL is where that becomes visible. A canary
+  # build is a nightly, not what a package called fluxer-bin ships, so that
+  # is EX_TEMPFAIL rather than a version - see scripts/update-package.sh.
+  # The version is shape-checked along with it: pkgver takes no hyphens, and
+  # a channel name in there would be one.
+  if [[ -z "$ver" || "$url" != */desktop/stable/linux/* || ! "$ver" =~ ^[0-9][0-9.]*$ ]]; then
+    echo "the stable channel's current download is \"${url:-<none>}\" at" \
+         "version \"${ver:-<none>}\", which is not a stable build -" \
+         "nothing to update to" >&2
+    return 75
+  fi
+
+  printf '%s\n' "$ver"
+}
+
+# _artifact_sha <arch> <version> - upstream's own checksum for that tarball,
+# published as a sha256sum-format sidecar next to the download itself
+_artifact_sha() {
+  local sha
+  sha="$(curl -sfL "$DL_BASE/$1/$2/tar_gz.sha256" | grep -ioEm1 '^[0-9a-f]{64}')"
+  [[ -n "$sha" ]] || { echo "upstream publishes no checksum for $1 $2" >&2; return 1; }
+  printf '%s\n' "$sha"
 }
 
 # refresh_checksums <version> <pkgbuild-path>
@@ -19,8 +61,8 @@ refresh_checksums() {
   local sha_desktop sha_x64 sha_arm64
 
   sha_desktop="$(sha256sum "$(dirname "$pkgbuild")/fluxer.desktop" | cut -d' ' -f1)"
-  sha_x64="$(curl -sfL "$DL_BASE/x64/$ver/tar_gz" | sha256sum | cut -d' ' -f1)"
+  sha_x64="$(_artifact_sha x64 "$ver")" || return 1
-  sha_arm64="$(curl -sfL "$DL_BASE/arm64/$ver/tar_gz" | sha256sum | cut -d' ' -f1)"
+  sha_arm64="$(_artifact_sha arm64 "$ver")" || return 1
 
   sed -i \
     -e "s|^sha256sums=.*|sha256sums=('$sha_desktop')|" \

kitty-tune-bin/.SRCINFO

@@ -0,0 +1,46 @@
+pkgbase = kitty-tune-bin
+	pkgdesc = SoundCloud and YouTube music player (upstream binary)
+	pkgver = 1.4.1
+	pkgrel = 1
+	url = https://github.com/alan7383/KittyTuneDesktop
+	arch = x86_64
+	arch = aarch64
+	license = MIT
+	depends = alsa-lib
+	depends = brotli
+	depends = bzip2
+	depends = expat
+	depends = fontconfig
+	depends = freetype2
+	depends = gcc-libs
+	depends = glibc
+	depends = gtk3
+	depends = hicolor-icon-theme
+	depends = libbsd
+	depends = libglvnd
+	depends = libmd
+	depends = libpng
+	depends = libx11
+	depends = libxau
+	depends = libxcb
+	depends = libxdmcp
+	depends = libxext
+	depends = libxi
+	depends = libxrender
+	depends = libxtst
+	depends = xdg-utils
+	depends = zlib
+	provides = kitty-tune=1.4.1
+	conflicts = kitty-tune
+	noextract = kitty-tune-bin-1.4.1-x86_64.deb
+	noextract = kitty-tune-bin-1.4.1-aarch64.deb
+	options = !strip
+	options = !debug
+	source = kitty-tune-bin-1.4.1-README.md::https://raw.githubusercontent.com/alan7383/KittyTuneDesktop/v1.4.1/README.md
+	sha256sums = bd8242976bf55d5b44ed3bad59d26baf2f2103d3244f20348630f30bd6d21eae
+	source_x86_64 = kitty-tune-bin-1.4.1-x86_64.deb::https://github.com/alan7383/KittyTuneDesktop/releases/download/v1.4.1/kitty-tune_1.4.1_amd64.deb
+	sha256sums_x86_64 = be47d51eea1bd400bb6a52c38b84043e55cd777d36c6a51ee2c519c118ae6a14
+	source_aarch64 = kitty-tune-bin-1.4.1-aarch64.deb::https://github.com/alan7383/KittyTuneDesktop/releases/download/v1.4.1/kitty-tune_1.4.1_arm64.deb
+	sha256sums_aarch64 = 3ffe6f0e9658040a92458a3071052a26aad83debcfb88d65d7ba80883a660f22
+
+pkgname = kitty-tune-bin

kitty-tune-bin/PKGBUILD

@@ -0,0 +1,57 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=kitty-tune-bin
+pkgver=1.4.1
+pkgrel=1
+pkgdesc="SoundCloud and YouTube music player (upstream binary)"
+arch=('x86_64' 'aarch64')
+url="https://github.com/alan7383/KittyTuneDesktop"
+license=('MIT')
+# jpackage bundles Java and FFmpeg. These are the system libraries declared
+# by both upstream .debs, plus GTK for the bundled JRE's desktop integration.
+depends=('alsa-lib' 'brotli' 'bzip2' 'expat' 'fontconfig' 'freetype2'
+         'gcc-libs' 'glibc' 'gtk3' 'hicolor-icon-theme' 'libbsd' 'libglvnd'
+         'libmd' 'libpng' 'libx11' 'libxau' 'libxcb' 'libxdmcp' 'libxext'
+         'libxi' 'libxrender' 'libxtst' 'xdg-utils' 'zlib')
+provides=("kitty-tune=${pkgver}")
+conflicts=('kitty-tune')
+options=('!strip' '!debug')
+# Upstream declares MIT in the README but ships no standalone license text.
+source=("${pkgname}-${pkgver}-README.md::https://raw.githubusercontent.com/alan7383/KittyTuneDesktop/v${pkgver}/README.md")
+source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::https://github.com/alan7383/KittyTuneDesktop/releases/download/v${pkgver}/kitty-tune_${pkgver}_amd64.deb")
+source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::https://github.com/alan7383/KittyTuneDesktop/releases/download/v${pkgver}/kitty-tune_${pkgver}_arm64.deb")
+noextract=("${pkgname}-${pkgver}-x86_64.deb" "${pkgname}-${pkgver}-aarch64.deb")
+sha256sums=('bd8242976bf55d5b44ed3bad59d26baf2f2103d3244f20348630f30bd6d21eae')
+sha256sums_x86_64=('be47d51eea1bd400bb6a52c38b84043e55cd777d36c6a51ee2c519c118ae6a14')
+sha256sums_aarch64=('3ffe6f0e9658040a92458a3071052a26aad83debcfb88d65d7ba80883a660f22')
+
+package() {
+  bsdtar -xOf "$srcdir/${pkgname}-${pkgver}-${CARCH}.deb" 'data.tar.*' \
+    | bsdtar -xpf - -C "$pkgdir" ./opt
+
+  install -d "$pkgdir/usr/bin"
+  ln -s /opt/kitty-tune/bin/KittyTune "$pkgdir/usr/bin/kitty-tune"
+
+  # The .deb registers this through postinst, which pacman never executes.
+  install -Dm644 "$pkgdir/opt/kitty-tune/lib/kitty-tune-KittyTune.desktop" \
+    "$pkgdir/usr/share/applications/kitty-tune.desktop"
+  sed -i \
+    -e 's|^Exec=.*|Exec=kitty-tune|' \
+    -e 's|^Icon=.*|Icon=kittytune|' \
+    -e 's|^Categories=.*|Categories=AudioVideo;Audio;Player;|' \
+    -e '/^MimeType=$/d' \
+    "$pkgdir/usr/share/applications/kitty-tune.desktop"
+  install -Dm644 "$pkgdir/opt/kitty-tune/lib/KittyTune.png" \
+    "$pkgdir/usr/share/icons/hicolor/512x512/apps/kittytune.png"
+
+  install -Dm644 "$srcdir/${pkgname}-${pkgver}-README.md" \
+    "$pkgdir/usr/share/licenses/$pkgname/README.md"
+  install -Dm644 "$pkgdir/opt/kitty-tune/share/doc/copyright" \
+    "$pkgdir/usr/share/licenses/$pkgname/copyright"
+
+  # The in-app updater installs upstream's differently named kitty-tune
+  # package. The conflict above prevents an unattended replacement; use an
+  # AUR helper to update kitty-tune-bin instead.
+}

kitty-tune-bin/pkg.sh

@@ -0,0 +1,28 @@
+# kitty-tune-bin - KittyTune Desktop, a Kotlin/Compose music player.
+# Repackage upstream's .debs for x86_64 and aarch64, including their JRE.
+
+UPSTREAM_REPO="alan7383/KittyTuneDesktop"
+
+latest_version() {
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' | sed 's/^v//'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local base sha_readme sha_x64 sha_arm64
+
+  base="https://github.com/$UPSTREAM_REPO/releases/download/v$ver"
+  sha_readme="$(set -o pipefail; curl -fsSL "https://raw.githubusercontent.com/$UPSTREAM_REPO/v$ver/README.md" \
+    | sha256sum | cut -d' ' -f1)" || return 1
+  sha_x64="$(set -o pipefail; curl -fsSL "$base/kitty-tune_${ver}_amd64.deb" \
+    | sha256sum | cut -d' ' -f1)" || return 1
+  sha_arm64="$(set -o pipefail; curl -fsSL "$base/kitty-tune_${ver}_arm64.deb" \
+    | sha256sum | cut -d' ' -f1)" || return 1
+
+  sed -i \
+    -e "s|^sha256sums=.*|sha256sums=('$sha_readme')|" \
+    -e "s|^sha256sums_x86_64=.*|sha256sums_x86_64=('$sha_x64')|" \
+    -e "s|^sha256sums_aarch64=.*|sha256sums_aarch64=('$sha_arm64')|" \
+    "$pkgbuild"
+}

lunar-client-bin/.SRCINFO

@@ -0,0 +1,19 @@
+pkgbase = lunar-client-bin
+	pkgdesc = PvP modpack for all modern versions of Minecraft (upstream AppImage)
+	pkgver = 3.7.17
+	pkgrel = 2
+	url = https://lunarclient.com
+	arch = x86_64
+	license = LicenseRef-proprietary
+	depends = fuse2
+	depends = xorg-xrandr
+	provides = lunar-client
+	provides = lunarclient
+	conflicts = lunar-client
+	conflicts = lunarclient
+	options = !strip
+	options = !debug
+	source = lunarclient-3.7.17.AppImage::https://launcherupdates.lunarclientcdn.com/Lunar%20Client-3.7.17-ow.AppImage
+	sha256sums = 4d298f99de13941c37f044623c02687d59ad52cbcedb7eab5d5b297db1937470
+
+pkgname = lunar-client-bin

lunar-client-bin/PKGBUILD

@@ -0,0 +1,60 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=lunar-client-bin
+_pkgname=lunarclient
+pkgver=3.7.17
+pkgrel=2
+pkgdesc="PvP modpack for all modern versions of Minecraft (upstream AppImage)"
+arch=('x86_64')
+url="https://lunarclient.com"
+license=('LicenseRef-proprietary')
+depends=('fuse2' 'xorg-xrandr')
+provides=('lunar-client' 'lunarclient')
+conflicts=('lunar-client' 'lunarclient')
+options=('!strip' '!debug')
+# maintained by CI together with pkgver (upstream varies the filename suffix)
+_appimage="Lunar%20Client-3.7.17-ow.AppImage"
+source=("${_pkgname}-${pkgver}.AppImage::https://launcherupdates.lunarclientcdn.com/${_appimage}")
+sha256sums=('4d298f99de13941c37f044623c02687d59ad52cbcedb7eab5d5b297db1937470')
+
+prepare() {
+  chmod +x "${_pkgname}-${pkgver}.AppImage"
+  "./${_pkgname}-${pkgver}.AppImage" --appimage-extract
+}
+
+build() {
+  # make the .desktop file work outside of the AppImage container
+  sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/${_pkgname}|" \
+    "squashfs-root/${_pkgname}.desktop"
+  # AppImage directory permissions are 700
+  chmod -R a-x+rX squashfs-root/usr
+}
+
+package() {
+  install -Dm755 "${srcdir}/${_pkgname}-${pkgver}.AppImage" \
+    "${pkgdir}/opt/${_pkgname}/${_pkgname}.AppImage"
+
+  install -Dm644 "${srcdir}/squashfs-root/${_pkgname}.desktop" \
+    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
+
+  install -Dm644 \
+    "${srcdir}/squashfs-root/usr/share/icons/hicolor/1024x1024/apps/${_pkgname}.png" \
+    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${_pkgname}.png"
+
+  install -dm755 "${pkgdir}/usr/bin"
+  ln -s "/opt/${_pkgname}/${_pkgname}.AppImage" "${pkgdir}/usr/bin/${_pkgname}"
+
+  # A custom licence has to ship its terms. Lunar Client publishes none in the
+  # AppImage, so what goes in is the reference to the terms it is used under.
+  install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<'EOF'
+Lunar Client is proprietary software, distributed by Moonsworth, LLC.
+
+It is not covered by a free-software licence: use is governed by the terms
+of service the vendor publishes, and redistribution of the AppImage this
+package installs is not granted by them.
+
+Terms of service: https://www.lunarclient.com/terms
+EOF
+}

lunar-client-bin/pkg.sh

@@ -0,0 +1,46 @@
+# lunar-client-bin - Lunar Client (https://lunarclient.com), Minecraft PvP
+# modpack launcher, proprietary Electron AppImage.
+#
+# Upstream hosts versioned AppImages itself, so there is no build_artifact():
+# on a new version pkgver, the artifact filename (_appimage) and the checksum
+# are refreshed. Upstream currently publishes on the "ow" electron-updater
+# channel (latest-ow-linux.yml) with an -ow filename suffix; the old plain
+# channel (latest-linux.yml) went stale but is still checked in case they
+# switch back - whichever carries the higher version wins.
+
+DL_BASE="https://launcherupdates.lunarclientcdn.com"
+
+_channel_version() {
+  curl -sf "$DL_BASE/$1" | grep -Po '^version: \K\S+'
+}
+
+latest_version() {
+  local a b
+  a="$(_channel_version latest-ow-linux.yml | sed 's/-.*//')"
+  b="$(_channel_version latest-linux.yml | sed 's/-.*//')"
+  [[ -n "$a" || -n "$b" ]] || return 1
+  if [[ -n "$a" && -n "$b" ]]; then
+    if [[ "$(vercmp "$a" "$b")" -ge 0 ]]; then echo "$a"; else echo "$b"; fi
+  else
+    echo "${a:-$b}"
+  fi
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local yml file sha
+  for yml in latest-ow-linux.yml latest-linux.yml; do
+    file="$(curl -sf "$DL_BASE/$yml" | grep -Po '^path: \K.*\.AppImage')"
+    [[ "$file" == *"$ver"* ]] && break
+    file=""
+  done
+  [[ -n "$file" ]] || { echo "no updater channel carries version $ver" >&2; return 1; }
+  file="${file// /%20}"
+
+  sha="$(curl -sfL "$DL_BASE/$file" | sha256sum | cut -d' ' -f1)"
+  sed -i \
+    -e "s|^_appimage=.*|_appimage=\"$file\"|" \
+    -e "s|^sha256sums=.*|sha256sums=('$sha')|" \
+    "$pkgbuild"
+}

middleclick-autoscroll/.SRCINFO

@@ -0,0 +1,25 @@
+pkgbase = middleclick-autoscroll
+	pkgdesc = Middle-click autoscroll in every application that supports it
+	pkgver = 1.7.0
+	pkgrel = 1
+	url = https://git.felo.gg/LoonixTools/middleclick-autoscroll
+	install = middleclick-autoscroll.install
+	arch = any
+	license = GPL-3.0-or-later
+	makedepends = gettext
+	makedepends = scdoc
+	depends = bash
+	depends = systemd
+	depends = coreutils
+	depends = gawk
+	depends = grep
+	depends = sed
+	depends = gettext
+	optdepends = flatpak: cover Flatpak applications too
+	optdepends = spotify-launcher: cover the official Spotify client
+	optdepends = steam: cover the Steam interface
+	optdepends = desktop-file-utils: refresh the desktop database after a change
+	source = middleclick-autoscroll-1.7.0.tar.gz::https://git.felo.gg/LoonixTools/middleclick-autoscroll/archive/v1.7.0.tar.gz
+	sha256sums = 2583f80d56effb0fefcb93b6623a6f8a6cfdcf31217b8ca283591a882f484ea2
+
+pkgname = middleclick-autoscroll

middleclick-autoscroll/PKGBUILD

@@ -0,0 +1,30 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=middleclick-autoscroll
+pkgver=1.7.0
+pkgrel=1
+pkgdesc="Middle-click autoscroll in every application that supports it"
+arch=('any')
+url="https://git.felo.gg/LoonixTools/middleclick-autoscroll"
+license=('GPL-3.0-or-later')
+depends=('bash' 'systemd' 'coreutils' 'gawk' 'grep' 'sed' 'gettext')
+makedepends=('gettext' 'scdoc')
+optdepends=('flatpak: cover Flatpak applications too'
+            'spotify-launcher: cover the official Spotify client'
+            'steam: cover the Steam interface'
+            'desktop-file-utils: refresh the desktop database after a change')
+install="${pkgname}.install"
+source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
+sha256sums=('2583f80d56effb0fefcb93b6623a6f8a6cfdcf31217b8ca283591a882f484ea2')
+
+build() {
+  # pass the version being packaged so `middleclick-autoscroll --version`
+  # cannot drift away from pkgver
+  make -C "${pkgname}" VERSION="$pkgver"
+}
+
+package() {
+  make -C "${pkgname}" VERSION="$pkgver" DESTDIR="$pkgdir" install
+}

middleclick-autoscroll/middleclick-autoscroll.install

@@ -0,0 +1,38 @@
+post_install() {
+  cat <<'EOF'
+
+  middleclick-autoscroll is installed but not active yet.
+
+    middleclick-autoscroll          interactive menu
+    middleclick-autoscroll enable   turn autoscroll on everywhere
+
+  Run it as your own user, not with sudo: it only ever writes inside your own
+  home directory, and there is nothing to configure by hand.
+
+EOF
+}
+
+post_upgrade() {
+  cat <<'EOF'
+
+  Run `middleclick-autoscroll apply` (or just open the menu) if the version
+  marker in your generated launcher entries should be refreshed.
+
+EOF
+}
+
+pre_remove() {
+  # The changes live in each user's home directory and cannot be undone from a
+  # root-run hook, so say so while the command that does it still exists.
+  cat <<'EOF'
+
+  Before removing this package, run
+
+    middleclick-autoscroll disable
+
+  as each user that enabled it. That puts back every launcher entry, flag file
+  and Steam script it changed. Removing the package without it leaves those
+  changes in place with nothing left to undo them.
+
+EOF
+}

middleclick-autoscroll/pkg.sh

@@ -0,0 +1,30 @@
+# middleclick-autoscroll - middle-click autoscroll for Chromium-based
+# applications (https://git.felo.gg/LoonixTools/middleclick-autoscroll).
+#
+# Pure shell plus a gettext catalog and a scdoc man page, so the PKGBUILD just
+# runs the upstream Makefile against the release tarball. Nothing is prebuilt
+# and nothing is republished - the AUR package builds exactly what the tag
+# contains.
+
+UPSTREAM_REPO="LoonixTools/middleclick-autoscroll"
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(gettext scdoc)
+
+latest_version() {
+  # the highest vX.Y.Z tag; not every release has a release page
+  curl -sf "https://git.felo.gg/api/v1/repos/$UPSTREAM_REPO/tags?limit=50" \
+    | jq -r '.[].name | select(test("^v[0-9]+(\\.[0-9]+)*$"))' \
+    | sed 's/^v//' | sort -V | tail -n 1
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local sha
+
+  sha="$(curl -sfL "https://git.felo.gg/$UPSTREAM_REPO/archive/v$ver.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i "s|^sha256sums=.*|sha256sums=('$sha')|" "$pkgbuild"
+}

modrinth-app-bin/.SRCINFO

@@ -0,0 +1,19 @@
+pkgbase = modrinth-app-bin
+	pkgdesc = Minecraft mod manager and launcher from Modrinth (upstream binary)
+	pkgver = 0.21.6
+	pkgrel = 1
+	url = https://modrinth.com/app
+	arch = x86_64
+	license = GPL-3.0-only
+	depends = webkit2gtk-4.1
+	depends = gtk3
+	depends = hicolor-icon-theme
+	provides = modrinth-app
+	conflicts = modrinth-app
+	noextract = modrinth-app-bin-0.21.6.deb
+	options = !strip
+	options = !debug
+	source = modrinth-app-bin-0.21.6.deb::https://github.com/modrinth/code/releases/download/v0.21.6/Modrinth.App_0.21.6_amd64.deb
+	sha256sums = e38d00d06b50b248954d7d1e097c6e8c99cd122907e88e1fb6202452e73de629
+
+pkgname = modrinth-app-bin

modrinth-app-bin/PKGBUILD

@@ -0,0 +1,24 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=modrinth-app-bin
+pkgver=0.21.6
+pkgrel=1
+pkgdesc="Minecraft mod manager and launcher from Modrinth (upstream binary)"
+arch=('x86_64')
+url="https://modrinth.com/app"
+license=('GPL-3.0-only')
+depends=('webkit2gtk-4.1' 'gtk3' 'hicolor-icon-theme')
+provides=('modrinth-app')
+conflicts=('modrinth-app')
+options=('!strip' '!debug')
+source=("${pkgname}-${pkgver}.deb::https://github.com/modrinth/code/releases/download/v${pkgver}/Modrinth.App_${pkgver}_amd64.deb")
+noextract=("${pkgname}-${pkgver}.deb")
+sha256sums=('e38d00d06b50b248954d7d1e097c6e8c99cd122907e88e1fb6202452e73de629')
+
+package() {
+  bsdtar -xOf "$srcdir/${pkgname}-${pkgver}.deb" 'data.tar.*' \
+    | bsdtar -xpf - -C "$pkgdir" usr
+  ln -s ModrinthApp "$pkgdir/usr/bin/modrinth-app"
+}

modrinth-app-bin/pkg.sh

@@ -0,0 +1,21 @@
+# modrinth-app-bin - Modrinth App (https://github.com/modrinth/code),
+# Minecraft mod manager/launcher, Tauri.
+#
+# Upstream publishes a bundled .deb per release, so there is no
+# build_artifact() here: on a new version only pkgver and the checksum are
+# refreshed and the PKGBUILD repackages the deb directly.
+
+UPSTREAM_REPO="modrinth/code"
+
+latest_version() {
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' | sed 's/^v//'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local sha
+  sha="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/v$ver/Modrinth.App_${ver}_amd64.deb" \
+    | sha256sum | cut -d' ' -f1)"
+  sed -i "s|^sha256sums=.*|sha256sums=('$sha')|" "$pkgbuild"
+}

modrinth-enhanced-bin/.SRCINFO

@@ -0,0 +1,38 @@
+pkgbase = modrinth-enhanced-bin
+	pkgdesc = Modrinth App without ads or telemetry, with offline and Ely.by accounts and Linux fixes (upstream binary)
+	pkgver = 0.21.6
+	pkgrel = 1
+	url = https://git.felo.gg/Felitendo/Modrinth-Enhanced
+	arch = x86_64
+	license = GPL-3.0-only
+	depends = cairo
+	depends = dbus
+	depends = gdk-pixbuf2
+	depends = glib2
+	depends = glibc
+	depends = gtk3
+	depends = hicolor-icon-theme
+	depends = libdrm
+	depends = libgcc
+	depends = libsoup3
+	depends = webkit2gtk-4.1
+	depends = libgl
+	depends = libpulse
+	depends = libx11
+	depends = libxcursor
+	depends = libxext
+	depends = libxxf86vm
+	optdepends = xorg-xrandr: for older Minecraft versions
+	provides = modrinth-enhanced
+	conflicts = modrinth-enhanced
+	noextract = modrinth-enhanced-bin-0.21.6.deb
+	options = !strip
+	options = !debug
+	source = modrinth-enhanced-bin-0.21.6.deb::https://git.felo.gg/Felitendo/Modrinth-Enhanced/releases/download/v0.21.6/Modrinth.Enhanced_0.21.6_amd64.deb
+	source = vblank-shim.c
+	source = modrinth-enhanced.sh
+	sha256sums = 229710df23441e8309c10580288c6c3f3151ed51b41a24e97eae474c6d0c829f
+	sha256sums = 0190921b8ff2fb1deec3209cba71c01541ca1f013e3ba41680f1636e185fd455
+	sha256sums = b24872f82645c52ee4804599cd678d138876fb193c754403fa9c5cf92bd745b9
+
+pkgname = modrinth-enhanced-bin

modrinth-enhanced-bin/PKGBUILD

@@ -0,0 +1,50 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=modrinth-enhanced-bin
+pkgver=0.21.6
+pkgrel=1
+pkgdesc="Modrinth App without ads or telemetry, with offline and Ely.by accounts and Linux fixes (upstream binary)"
+arch=('x86_64')
+url="https://git.felo.gg/Felitendo/Modrinth-Enhanced"
+license=('GPL-3.0-only')
+depends=('cairo' 'dbus' 'gdk-pixbuf2' 'glib2' 'glibc' 'gtk3' 'hicolor-icon-theme'
+         'libdrm' 'libgcc' 'libsoup3' 'webkit2gtk-4.1'
+         # loaded by Minecraft, not by the launcher
+         'libgl' 'libpulse' 'libx11' 'libxcursor' 'libxext' 'libxxf86vm')
+optdepends=('xorg-xrandr: for older Minecraft versions')
+provides=('modrinth-enhanced')
+conflicts=('modrinth-enhanced')
+options=('!strip' '!debug')
+# A new revision of the patches on the same Modrinth App release is tagged
+# v0.21.2-2, which pkgver spells 0.21.2.r2; see pkg.sh.
+_tag="v0.21.6"
+_asset="Modrinth.Enhanced_0.21.6_amd64.deb"
+# With the NVIDIA driver WebKitGTK paces the app with a 60 fps timer whatever
+# the monitor's refresh rate. vblank-shim.c, preloaded by modrinth-enhanced.sh,
+# paces it at the monitor's rate instead and keeps the app on X11, the only
+# place that works; it is not part of upstream's release.
+source=("${pkgname}-${pkgver}.deb::https://git.felo.gg/Felitendo/Modrinth-Enhanced/releases/download/${_tag}/${_asset}"
+        "vblank-shim.c"
+        "modrinth-enhanced.sh")
+noextract=("${pkgname}-${pkgver}.deb")
+sha256sums=('229710df23441e8309c10580288c6c3f3151ed51b41a24e97eae474c6d0c829f' '0190921b8ff2fb1deec3209cba71c01541ca1f013e3ba41680f1636e185fd455' 'b24872f82645c52ee4804599cd678d138876fb193c754403fa9c5cf92bd745b9')
+
+build() {
+  # GLib for its headers only: the shim looks GTK and GLib up at run time
+  gcc $CPPFLAGS $CFLAGS $LDFLAGS -shared -fPIC -o libwebkit-vblank-shim.so vblank-shim.c \
+    $(pkg-config --cflags glib-2.0) $(pkg-config --cflags --libs libdrm)
+}
+
+package() {
+  bsdtar -xOf "$srcdir/${pkgname}-${pkgver}.deb" 'data.tar.*' \
+    | bsdtar -xpf - -C "$pkgdir" usr
+
+  # the binary moves behind the script that preloads the shim
+  install -d "$pkgdir/usr/lib/modrinth-enhanced"
+  mv "$pkgdir/usr/bin/ModrinthEnhanced" "$pkgdir/usr/lib/modrinth-enhanced/"
+  install -Dm755 libwebkit-vblank-shim.so -t "$pkgdir/usr/lib/modrinth-enhanced/"
+  install -Dm755 modrinth-enhanced.sh "$pkgdir/usr/bin/ModrinthEnhanced"
+  ln -s ModrinthEnhanced "$pkgdir/usr/bin/modrinth-enhanced"
+}

modrinth-enhanced-bin/modrinth-enhanced.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+# Starts Modrinth Enhanced with the vblank shim preloaded (see vblank-shim.c).
+# With the NVIDIA driver the shim only lifts the frame rate under X11, so it is
+# asked to keep GTK on X11 there. MODRINTH_VBLANK_SHIM=0 starts the app without.
+if [ "${MODRINTH_VBLANK_SHIM:-1}" != 0 ]; then
+  [ -d /sys/module/nvidia_drm ] && export VBLANK_SHIM_GDK_BACKEND=x11
+  export LD_PRELOAD="/usr/lib/modrinth-enhanced/libwebkit-vblank-shim.so${LD_PRELOAD:+:$LD_PRELOAD}"
+fi
+exec /usr/lib/modrinth-enhanced/ModrinthEnhanced "$@"

modrinth-enhanced-bin/pkg.sh

@@ -0,0 +1,54 @@
+# modrinth-enhanced-bin - Modrinth Enhanced (https://git.felo.gg/Felitendo/Modrinth-Enhanced),
+# the Modrinth App (Tauri) with a series of patches applied: no ads, no
+# telemetry, offline and Ely.by accounts, Linux fixes.
+#
+# Upstream publishes a bundled .deb per release, so the app is not built here:
+# on a new version only pkgver, the tag, the asset name and the checksums are
+# refreshed and the PKGBUILD repackages the deb directly. The only thing built
+# is vblank-shim.c, which ships with this package (see the PKGBUILD).
+#
+# Releases are tagged after the Modrinth App release they are built on
+# (v0.21.2). When the patches change without a new Modrinth App release, the
+# rebuild is tagged as a revision (v0.21.2-2) while the app and its .deb keep
+# the plain version. pkgver turns the hyphen into ".r" (0.21.2.r2), which
+# pacman sorts after 0.21.2 and before 0.21.3, so no epoch is needed.
+#
+# Upstream's release workflow creates the release together with its assets
+# only after all three platforms built, so /releases/latest never points at a
+# release whose .deb is still missing.
+
+UPSTREAM_REPO="Felitendo/Modrinth-Enhanced"
+
+# Installed in CI before the makepkg test build, for the shim's headers.
+BUILD_DEPS=(glib2 libdrm)
+
+latest_version() {
+  curl -sf "https://git.felo.gg/api/v1/repos/$UPSTREAM_REPO/releases/latest" \
+    | jq -r '.tag_name' | sed 's/^v//; s/-/.r/'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local tag="v${ver/.r/-}" dir asset sha sha_shim sha_script
+
+  dir="$(dirname "$pkgbuild")"
+  sha_shim="$(sha256sum "$dir/vblank-shim.c" | cut -d' ' -f1)"
+  sha_script="$(sha256sum "$dir/modrinth-enhanced.sh" | cut -d' ' -f1)"
+
+  asset="$(curl -sf "https://git.felo.gg/api/v1/repos/$UPSTREAM_REPO/releases/tags/$tag" \
+    | jq -r '.assets[].name | select(endswith("_amd64.deb"))')"
+  if [[ -z "$asset" || "$asset" == *$'\n'* ]]; then
+    echo "could not find exactly one amd64 .deb in release $tag" >&2
+    return 1
+  fi
+
+  sha="$(curl -sfL "https://git.felo.gg/$UPSTREAM_REPO/releases/download/$tag/$asset" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i \
+    -e "s|^_tag=.*|_tag=\"$tag\"|" \
+    -e "s|^_asset=.*|_asset=\"$asset\"|" \
+    -e "s|^sha256sums=.*|sha256sums=('$sha' '$sha_shim' '$sha_script')|" \
+    "$pkgbuild"
+}

modrinth-enhanced-bin/vblank-shim.c

@@ -0,0 +1,437 @@
+// LD_PRELOAD shim that lets Modrinth Enhanced (WebKitGTK 4.1 on GTK3) draw at
+// the monitor's refresh rate with the NVIDIA driver instead of 60 Hz.
+//
+// Three things hold it at 60 Hz there:
+//  1. WebKitGTK looks for the DRM CRTC of the monitor a window is on by
+//     physical size, and the NVIDIA DRM connector reports slightly different
+//     millimetres than GDK does, so no CRTC is found.
+//  2. The NVIDIA DRM driver does not implement DRM_IOCTL_WAIT_VBLANK, so even a
+//     found CRTC cannot be waited on. WebKit then paces with a 60 fps timer.
+//  3. GTK3 paces its own paints from the refresh interval the display server
+//     reports, and assumes 60 Hz without one. KWin reports none to it, on X11
+//     (no _NET_WM_FRAME_TIMINGS for XWayland clients) and on Wayland alike.
+//
+// This shim:
+//  1. corrects the connector size to what GDK reports for the same monitor,
+//     found by output name on X11 ("DP-1") or EDID model name on Wayland;
+//  2. emulates blocking vblank waits at the CRTC's refresh rate when the
+//     driver refuses them;
+//  3. fills in the monitor refresh interval on GTK3 frame timings that were
+//     left without one.
+//
+// Each step only stands in for what is missing, so with drivers that report
+// all of it the shim changes nothing.
+//
+// The frame rate only comes through on X11: on Wayland something in GTK3 or
+// WebKit still asks for 60 frames a second. VBLANK_SHIM_GDK_BACKEND=x11 keeps
+// GTK on X11 without setting GDK_BACKEND, which every program the app starts
+// would inherit. A GDK_BACKEND the user set still wins.
+//
+// Build: gcc -shared -fPIC -O2 -o libwebkit-vblank-shim.so vblank-shim.c $(pkg-config --cflags glib-2.0) $(pkg-config --cflags --libs libdrm)
+// Debug: VBLANK_SHIM_DEBUG=1
+// Knobs: VBLANK_SHIM_RATE_MULTIPLIER (vblank emulation), VBLANK_SHIM_REFRESH_HZ
+//        (GTK frame timings, default: fastest monitor), VBLANK_SHIM_FRAME_CLOCK=0
+//        (leave GTK frame timings alone)
+
+#define _GNU_SOURCE
+#include <ctype.h>
+#include <dlfcn.h>
+#include <errno.h>
+#include <glib-object.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <xf86drm.h>
+#include <xf86drmMode.h>
+
+typedef struct _GdkDisplay GdkDisplay;
+typedef struct _GdkMonitor GdkMonitor;
+typedef struct _GdkWindow GdkWindow;
+typedef struct _GdkFrameClock GdkFrameClock;
+typedef struct _GdkFrameTimings GdkFrameTimings;
+
+static int debug_enabled(void) {
+    static int value = -1;
+    if (value < 0) value = getenv("VBLANK_SHIM_DEBUG") != NULL;
+    return value;
+}
+
+#define debug(...) do { if (debug_enabled()) fprintf(stderr, "vblank-shim: " __VA_ARGS__); } while (0)
+
+// --- 0. Window system -------------------------------------------------------
+
+static char gdk_backend[16];
+
+// Read on load, while nothing else runs, and taken out of the environment.
+__attribute__((constructor))
+static void take_gdk_backend(void) {
+    const char *backend = getenv("VBLANK_SHIM_GDK_BACKEND");
+    if (!backend) return;
+    snprintf(gdk_backend, sizeof gdk_backend, "%s", backend);
+    unsetenv("VBLANK_SHIM_GDK_BACKEND");
+}
+
+static void select_gdk_backend(void) {
+    if (!gdk_backend[0] || getenv("GDK_BACKEND")) return;
+    void (*set_allowed_backends)(const char *) = dlsym(RTLD_DEFAULT, "gdk_set_allowed_backends");
+    if (set_allowed_backends) {
+        set_allowed_backends(gdk_backend);
+        debug("GDK limited to %s\n", gdk_backend);
+    }
+    gdk_backend[0] = '\0';
+}
+
+int gtk_init_check(int *argc, char ***argv) {
+    static int (*real)(int *, char ***);
+    if (!real) real = dlsym(RTLD_NEXT, "gtk_init_check");
+    select_gdk_backend();
+    return real(argc, argv);
+}
+
+void gtk_init(int *argc, char ***argv) {
+    static void (*real)(int *, char ***);
+    if (!real) real = dlsym(RTLD_NEXT, "gtk_init");
+    select_gdk_backend();
+    real(argc, argv);
+}
+
+// WebKit waits for vblank and GTK paints in the process the shim is preloaded
+// into. Its children - WebKit's helper processes, and Minecraft started from
+// the launcher - have no use for it, so it leaves LD_PRELOAD on load and keeps
+// whatever else is in there.
+__attribute__((constructor))
+static void leave_ld_preload(void) {
+    const char *preload = getenv("LD_PRELOAD");
+    Dl_info info;
+    if (!preload || !dladdr((void *)leave_ld_preload, &info) || !info.dli_fname) return;
+    const char *self = strrchr(info.dli_fname, '/');
+    self = self ? self + 1 : info.dli_fname;
+
+    char *entries = strdup(preload), *kept = calloc(1, strlen(preload) + 1);
+    if (entries && kept) {
+        char *save = NULL;
+        for (char *entry = strtok_r(entries, ": ", &save); entry; entry = strtok_r(NULL, ": ", &save)) {
+            const char *name = strrchr(entry, '/');
+            if (strcmp(name ? name + 1 : entry, self) == 0) continue;
+            if (*kept) strcat(kept, ":");
+            strcat(kept, entry);
+        }
+        if (*kept) setenv("LD_PRELOAD", kept, 1);
+        else unsetenv("LD_PRELOAD");
+    }
+    free(entries);
+    free(kept);
+}
+
+// GTK and GLib are looked up at run time rather than linked, so the shim loads
+// into processes without them (such as the shell script that starts the
+// AppImage) and still finds them when they are loaded later with dlopen.
+static struct {
+    GdkDisplay *(*display_get_default)(void);
+    int (*display_get_n_monitors)(GdkDisplay *);
+    GdkMonitor *(*display_get_monitor)(GdkDisplay *, int);
+    const char *(*monitor_get_model)(GdkMonitor *);
+    int (*monitor_get_width_mm)(GdkMonitor *);
+    int (*monitor_get_height_mm)(GdkMonitor *);
+    int (*monitor_get_refresh_rate)(GdkMonitor *);
+    GType (*frame_clock_get_type)(void);
+    GdkFrameTimings *(*frame_clock_get_current_timings)(GdkFrameClock *);
+    gint64 (*frame_timings_get_refresh_interval)(GdkFrameTimings *);
+    gpointer (*type_class_ref)(GType);
+    guint (*signal_lookup)(const gchar *, GType);
+    gulong (*signal_add_emission_hook)(guint, GQuark, GSignalEmissionHook, gpointer, GDestroyNotify);
+    gpointer (*value_get_object)(const GValue *);
+} gtk;
+
+static int gtk_resolved(void) {
+    if (gtk.value_get_object) return 1;
+    #define RESOLVE(field, name) if (!(gtk.field = dlsym(RTLD_DEFAULT, name))) return 0
+    RESOLVE(display_get_default, "gdk_display_get_default");
+    RESOLVE(display_get_n_monitors, "gdk_display_get_n_monitors");
+    RESOLVE(display_get_monitor, "gdk_display_get_monitor");
+    RESOLVE(monitor_get_model, "gdk_monitor_get_model");
+    RESOLVE(monitor_get_width_mm, "gdk_monitor_get_width_mm");
+    RESOLVE(monitor_get_height_mm, "gdk_monitor_get_height_mm");
+    RESOLVE(monitor_get_refresh_rate, "gdk_monitor_get_refresh_rate");
+    RESOLVE(frame_clock_get_type, "gdk_frame_clock_get_type");
+    RESOLVE(frame_clock_get_current_timings, "gdk_frame_clock_get_current_timings");
+    RESOLVE(frame_timings_get_refresh_interval, "gdk_frame_timings_get_refresh_interval");
+    RESOLVE(type_class_ref, "g_type_class_ref");
+    RESOLVE(signal_lookup, "g_signal_lookup");
+    RESOLVE(signal_add_emission_hook, "g_signal_add_emission_hook");
+    RESOLVE(value_get_object, "g_value_get_object");
+    #undef RESOLVE
+    return 1;
+}
+
+// --- 1. Connector size ------------------------------------------------------
+
+static const char *connector_prefix(uint32_t type) {
+    switch (type) {
+    case DRM_MODE_CONNECTOR_DisplayPort: return "DP";
+    case DRM_MODE_CONNECTOR_HDMIA: return "HDMI-A";
+    case DRM_MODE_CONNECTOR_HDMIB: return "HDMI-B";
+    case DRM_MODE_CONNECTOR_DVID: return "DVI-D";
+    case DRM_MODE_CONNECTOR_DVII: return "DVI-I";
+    case DRM_MODE_CONNECTOR_eDP: return "eDP";
+    case DRM_MODE_CONNECTOR_VGA: return "VGA";
+    default: return NULL;
+    }
+}
+
+// The monitor name descriptor (0xFC) of the connector's EDID, which is what
+// GDK's Wayland backend reports as the monitor model.
+static void edid_model_name(int fd, uint32_t connector_id, char *out, size_t size) {
+    out[0] = '\0';
+    drmModeObjectPropertiesPtr props = drmModeObjectGetProperties(fd, connector_id, DRM_MODE_OBJECT_CONNECTOR);
+    if (!props) return;
+    for (uint32_t i = 0; i < props->count_props && !out[0]; i++) {
+        drmModePropertyPtr prop = drmModeGetProperty(fd, props->props[i]);
+        if (prop && strcmp(prop->name, "EDID") == 0 && props->prop_values[i]) {
+            drmModePropertyBlobPtr blob = drmModeGetPropertyBlob(fd, props->prop_values[i]);
+            if (blob && blob->length >= 128) {
+                const unsigned char *edid = blob->data;
+                for (int d = 54; d <= 108; d += 18) {
+                    if (edid[d] || edid[d + 1] || edid[d + 2] || edid[d + 3] != 0xFC) continue;
+                    size_t n = 0;
+                    for (int k = 5; k < 18 && n + 1 < size && edid[d + k] != '\n'; k++) out[n++] = edid[d + k];
+                    while (n && isspace((unsigned char)out[n - 1])) n--;
+                    out[n] = '\0';
+                    break;
+                }
+            }
+            drmModeFreePropertyBlob(blob);
+        }
+        drmModeFreeProperty(prop);
+    }
+    drmModeFreeObjectProperties(props);
+}
+
+drmModeConnectorPtr drmModeGetConnector(int fd, uint32_t connector_id) {
+    static drmModeConnectorPtr (*real)(int, uint32_t);
+    if (!real) real = dlsym(RTLD_NEXT, "drmModeGetConnector");
+    drmModeConnectorPtr connector = real(fd, connector_id);
+    if (!connector || connector->connection != DRM_MODE_CONNECTED || !gtk_resolved()) return connector;
+
+    GdkDisplay *display = gtk.display_get_default();
+    if (!display) return connector;
+
+    char output_name[32] = "";
+    const char *prefix = connector_prefix(connector->connector_type);
+    if (prefix) snprintf(output_name, sizeof output_name, "%s-%u", prefix, connector->connector_type_id);
+    char edid_name[32];
+    edid_model_name(fd, connector_id, edid_name, sizeof edid_name);
+
+    for (int i = 0; i < gtk.display_get_n_monitors(display); i++) {
+        GdkMonitor *monitor = gtk.display_get_monitor(display, i);
+        const char *model = gtk.monitor_get_model(monitor);
+        if (!model) continue;
+        if (!(output_name[0] && strcmp(model, output_name) == 0) && !(edid_name[0] && strcmp(model, edid_name) == 0))
+            continue;
+        int w = gtk.monitor_get_width_mm(monitor), h = gtk.monitor_get_height_mm(monitor);
+        if (w > 0 && h > 0 && ((uint32_t)w != connector->mmWidth || (uint32_t)h != connector->mmHeight)) {
+            debug("%s (%s): connector size %ux%u mm -> %dx%d mm (as GDK reports)\n", output_name, edid_name,
+                  connector->mmWidth, connector->mmHeight, w, h);
+            connector->mmWidth = w;
+            connector->mmHeight = h;
+        }
+        break;
+    }
+    return connector;
+}
+
+// --- 2. Vblank emulation ----------------------------------------------------
+
+struct emulated_crtc {
+    int fd;
+    unsigned index;
+    long long period_ns;
+    struct timespec base;
+};
+
+static struct emulated_crtc crtcs[16];
+static int crtc_count;
+static pthread_mutex_t crtcs_lock = PTHREAD_MUTEX_INITIALIZER;
+
+static long long to_ns(const struct timespec *t) {
+    return (long long)t->tv_sec * 1000000000LL + t->tv_nsec;
+}
+
+static double rate_multiplier(void) {
+    const char *value = getenv("VBLANK_SHIM_RATE_MULTIPLIER");
+    double multiplier = value ? atof(value) : 1.0;
+    return multiplier >= 1.0 ? multiplier : 1.0;
+}
+
+static long long refresh_period_ns(int fd, unsigned index) {
+    long long period = (long long)(1e9 / (60 * rate_multiplier()));
+    drmModeResPtr resources = drmModeGetResources(fd);
+    if (!resources) return period;
+    if ((int)index < resources->count_crtcs) {
+        drmModeCrtcPtr crtc = drmModeGetCrtc(fd, resources->crtcs[index]);
+        if (crtc && crtc->mode_valid && crtc->mode.htotal && crtc->mode.vtotal) {
+            const drmModeModeInfo *mode = &crtc->mode;
+            double hz = mode->clock * 1000.0 / ((double)mode->htotal * mode->vtotal);
+            if (mode->flags & DRM_MODE_FLAG_INTERLACE) hz *= 2;
+            if (mode->flags & DRM_MODE_FLAG_DBLSCAN) hz /= 2;
+            if (mode->vscan > 1) hz /= mode->vscan;
+            if (hz > 1) period = (long long)(1e9 / (hz * rate_multiplier()));
+            debug("emulating vblank for crtc index %u at %.3f Hz x %.1f\n", index, hz, rate_multiplier());
+        }
+        drmModeFreeCrtc(crtc);
+    }
+    drmModeFreeResources(resources);
+    return period;
+}
+
+static struct emulated_crtc *emulated_crtc_for(int fd, unsigned index) {
+    pthread_mutex_lock(&crtcs_lock);
+    struct emulated_crtc *found = NULL;
+    for (int i = 0; i < crtc_count; i++) {
+        if (crtcs[i].fd == fd && crtcs[i].index == index) {
+            found = &crtcs[i];
+            break;
+        }
+    }
+    if (!found && crtc_count < (int)(sizeof crtcs / sizeof crtcs[0])) {
+        found = &crtcs[crtc_count++];
+        found->fd = fd;
+        found->index = index;
+        found->period_ns = refresh_period_ns(fd, index);
+        clock_gettime(CLOCK_MONOTONIC, &found->base);
+    }
+    pthread_mutex_unlock(&crtcs_lock);
+    return found;
+}
+
+int drmWaitVBlank(int fd, drmVBlankPtr vbl) {
+    static int (*real)(int, drmVBlankPtr);
+    if (!real) real = dlsym(RTLD_NEXT, "drmWaitVBlank");
+
+    drmVBlankReq request = vbl->request;
+    int ret = real(fd, vbl);
+    if (ret == 0) return 0;
+
+    int error = errno;
+    // Only stand in for a driver that does not do vblank waits at all, and only
+    // for plain blocking waits.
+    if ((error != EOPNOTSUPP && error != EPERM) || (request.type & (DRM_VBLANK_EVENT | DRM_VBLANK_SIGNAL))) {
+        errno = error;
+        return ret;
+    }
+
+    unsigned index = (request.type & DRM_VBLANK_SECONDARY)
+        ? 1
+        : (request.type & DRM_VBLANK_HIGH_CRTC_MASK) >> DRM_VBLANK_HIGH_CRTC_SHIFT;
+    struct emulated_crtc *crtc = emulated_crtc_for(fd, index);
+    if (!crtc) {
+        errno = error;
+        return ret;
+    }
+
+    struct timespec now;
+    clock_gettime(CLOCK_MONOTONIC, &now);
+    long long base = to_ns(&crtc->base);
+    long long current = (to_ns(&now) - base) / crtc->period_ns;
+    long long target;
+    if (request.type & DRM_VBLANK_RELATIVE) {
+        target = current + request.sequence;
+    } else {
+        target = request.sequence;
+        if (target <= current && (request.type & DRM_VBLANK_NEXTONMISS)) target = current + 1;
+    }
+    if (target < current) target = current;
+
+    long long when = base + target * crtc->period_ns;
+    if (target > current) {
+        struct timespec until = { when / 1000000000LL, when % 1000000000LL };
+        while (clock_nanosleep(CLOCK_MONOTONIC, TIMER_ABSTIME, &until, NULL) == EINTR) {
+        }
+    }
+
+    vbl->reply.type = request.type;
+    vbl->reply.sequence = (unsigned)target;
+    vbl->reply.tval_sec = when / 1000000000LL;
+    vbl->reply.tval_usec = (when % 1000000000LL) / 1000;
+    return 0;
+}
+
+// --- 3. GTK3 frame timings --------------------------------------------------
+
+static gint64 frame_refresh_interval_us;
+// Offset of the refresh_interval field inside GdkFrameTimings, found through
+// the public getter rather than assumed. -1: not found yet, -2: give up.
+static long refresh_interval_offset = -1;
+
+static gint64 monitor_refresh_interval_us(void) {
+    const char *forced = getenv("VBLANK_SHIM_REFRESH_HZ");
+    if (forced && atof(forced) > 1) return (gint64)(1e6 / atof(forced));
+    GdkDisplay *display = gtk.display_get_default();
+    if (!display) return 0;
+    int fastest = 0;
+    for (int i = 0; i < gtk.display_get_n_monitors(display); i++) {
+        int rate = gtk.monitor_get_refresh_rate(gtk.display_get_monitor(display, i));
+        if (rate > fastest) fastest = rate;
+    }
+    // GDK reports milli-hertz.
+    return fastest > 0 ? (gint64)(1000000000LL / fastest) : 0;
+}
+
+static long find_refresh_interval_offset(GdkFrameTimings *timings) {
+    gint64 *slots = (gint64 *)timings;
+    // The struct starts with a guint ref_count; the gint64 fields follow it.
+    for (long offset = 8; offset <= 96; offset += 8) {
+        gint64 saved = slots[offset / 8];
+        slots[offset / 8] = 0x5eed5eed5eedLL;
+        gboolean match = gtk.frame_timings_get_refresh_interval(timings) == 0x5eed5eed5eedLL;
+        slots[offset / 8] = saved;
+        if (match) return offset;
+    }
+    return -2;
+}
+
+static gboolean after_paint_hook(GSignalInvocationHint *hint, guint n_params, const GValue *params, gpointer data) {
+    (void)hint;
+    (void)data;
+    if (n_params < 1 || refresh_interval_offset == -2) return TRUE;
+    GdkFrameTimings *timings = gtk.frame_clock_get_current_timings(gtk.value_get_object(&params[0]));
+    // Only frames the backend left without a refresh interval.
+    if (!timings || gtk.frame_timings_get_refresh_interval(timings) != 0) return TRUE;
+
+    if (!frame_refresh_interval_us) frame_refresh_interval_us = monitor_refresh_interval_us();
+    if (frame_refresh_interval_us <= 0) return TRUE;
+    if (refresh_interval_offset == -1) {
+        refresh_interval_offset = find_refresh_interval_offset(timings);
+        if (refresh_interval_offset < 0) {
+            debug("could not locate refresh_interval in GdkFrameTimings, leaving GTK alone\n");
+            return TRUE;
+        }
+        debug("GTK frame timings: refresh interval %" G_GINT64_FORMAT " us (offset %ld)\n",
+              frame_refresh_interval_us, refresh_interval_offset);
+    }
+    ((gint64 *)timings)[refresh_interval_offset / 8] = frame_refresh_interval_us;
+    return TRUE;
+}
+
+static void install_frame_clock_hook(void) {
+    const char *enabled = getenv("VBLANK_SHIM_FRAME_CLOCK");
+    if (enabled && strcmp(enabled, "0") == 0) return;
+    if (!gtk_resolved()) return;
+    GType type = gtk.frame_clock_get_type();
+    gtk.type_class_ref(type);  // signals exist once the class does; keep it alive
+    guint signal = gtk.signal_lookup("after-paint", type);
+    if (!signal) return;
+    gtk.signal_add_emission_hook(signal, 0, after_paint_hook, NULL, NULL);
+    debug("installed GTK after-paint hook\n");
+}
+
+GdkFrameClock *gdk_window_get_frame_clock(GdkWindow *window) {
+    static GdkFrameClock *(*real)(GdkWindow *);
+    static pthread_once_t once = PTHREAD_ONCE_INIT;
+    if (!real) real = dlsym(RTLD_NEXT, "gdk_window_get_frame_clock");
+    GdkFrameClock *clock = real(window);
+    if (clock) pthread_once(&once, install_frame_clock_hook);
+    return clock;
+}

modrinth-enhanced/.SRCINFO

@@ -0,0 +1,45 @@
+pkgbase = modrinth-enhanced
+	pkgdesc = Modrinth App without ads or telemetry, with offline and Ely.by accounts and Linux fixes
+	pkgver = 0.21.6
+	pkgrel = 1
+	url = https://git.felo.gg/Felitendo/Modrinth-Enhanced
+	arch = x86_64
+	license = GPL-3.0-only
+	makedepends = cargo
+	makedepends = git
+	makedepends = jdk17-openjdk
+	makedepends = node-gyp
+	makedepends = nodejs>=24.15.0
+	makedepends = npm
+	makedepends = pnpm
+	depends = cairo
+	depends = dbus
+	depends = gdk-pixbuf2
+	depends = glib2
+	depends = glibc
+	depends = gtk3
+	depends = hicolor-icon-theme
+	depends = libdrm
+	depends = libgcc
+	depends = libsoup3
+	depends = webkit2gtk-4.1
+	depends = libgl
+	depends = libpulse
+	depends = libx11
+	depends = libxcursor
+	depends = libxext
+	depends = libxxf86vm
+	optdepends = xorg-xrandr: for older Minecraft versions
+	noextract = modrinth-code-v0.21.6.tar.gz
+	options = !lto
+	options = !debug
+	source = modrinth-enhanced-v0.21.6.tar.gz::https://git.felo.gg/Felitendo/Modrinth-Enhanced/archive/v0.21.6.tar.gz
+	source = modrinth-code-v0.21.6.tar.gz::https://github.com/modrinth/code/archive/refs/tags/v0.21.6.tar.gz
+	source = vblank-shim.c
+	source = modrinth-enhanced.sh
+	sha256sums = 0bf2326e345ba2c6f25a6954538d20b4b63d7010ccdd54281186bac1196ef493
+	sha256sums = dd058ca164096a0f9aeeffec5dfa7905979719a33976643895806b0c82b6f409
+	sha256sums = 0190921b8ff2fb1deec3209cba71c01541ca1f013e3ba41680f1636e185fd455
+	sha256sums = b24872f82645c52ee4804599cd678d138876fb193c754403fa9c5cf92bd745b9
+
+pkgname = modrinth-enhanced

modrinth-enhanced/PKGBUILD

@@ -0,0 +1,142 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=modrinth-enhanced
+pkgver=0.21.6
+pkgrel=1
+pkgdesc="Modrinth App without ads or telemetry, with offline and Ely.by accounts and Linux fixes"
+arch=('x86_64')
+url="https://git.felo.gg/Felitendo/Modrinth-Enhanced"
+license=('GPL-3.0-only')
+depends=('cairo' 'dbus' 'gdk-pixbuf2' 'glib2' 'glibc' 'gtk3' 'hicolor-icon-theme'
+         'libdrm' 'libgcc' 'libsoup3' 'webkit2gtk-4.1'
+         # loaded by Minecraft, not by the launcher
+         'libgl' 'libpulse' 'libx11' 'libxcursor' 'libxext' 'libxxf86vm')
+# git replays the patches the way upstream's scripts/prepare.sh does; the JDK
+# builds the Java agent, whose Gradle toolchain asks for exactly 17
+makedepends=('cargo' 'git' 'jdk17-openjdk' 'node-gyp' 'nodejs>=24.15.0' 'npm' 'pnpm')
+optdepends=('xorg-xrandr: for older Minecraft versions')
+# the release profile carries no debug info, so a -debug package would be empty
+options=('!lto' '!debug')
+# Modrinth Enhanced holds no forked source, only patches. Its release tag
+# records the Modrinth App release it was built on (upstream.txt) and the one
+# the patches were exported against (patches/base.txt); pkg.sh reads both.
+# A new revision of the patches on the same release is tagged v0.21.2-2, which
+# pkgver spells 0.21.2.r2.
+_tag="v0.21.6"
+_upstream="v0.21.6"
+_base="v0.21.6"
+# With the NVIDIA driver WebKitGTK paces the app with a 60 fps timer whatever
+# the monitor's refresh rate. vblank-shim.c, preloaded by modrinth-enhanced.sh,
+# paces it at the monitor's rate instead and keeps the app on X11, the only
+# place that works; it is not part of upstream's release.
+source=("${pkgname}-${_tag}.tar.gz::https://git.felo.gg/Felitendo/Modrinth-Enhanced/archive/${_tag}.tar.gz"
+        "modrinth-code-${_upstream}.tar.gz::https://github.com/modrinth/code/archive/refs/tags/${_upstream}.tar.gz"
+        "vblank-shim.c"
+        "modrinth-enhanced.sh")
+noextract=("modrinth-code-${_upstream}.tar.gz")
+if [[ "$_base" != "$_upstream" ]]; then
+  source+=("modrinth-code-${_base}.tar.gz::https://github.com/modrinth/code/archive/refs/tags/${_base}.tar.gz")
+  noextract+=("modrinth-code-${_base}.tar.gz")
+fi
+sha256sums=('0bf2326e345ba2c6f25a6954538d20b4b63d7010ccdd54281186bac1196ef493' 'dd058ca164096a0f9aeeffec5dfa7905979719a33976643895806b0c82b6f409' '0190921b8ff2fb1deec3209cba71c01541ca1f013e3ba41680f1636e185fd455' 'b24872f82645c52ee4804599cd678d138876fb193c754403fa9c5cf92bd745b9')
+
+prepare() {
+  # What upstream's scripts/prepare.sh does with two shallow tags: apply the
+  # patches to the release they were exported against, where they always fit,
+  # then rebase them onto the release this version was built on, so that a
+  # change upstream made near a patch is merged instead of failing to apply.
+  export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+  export GIT_AUTHOR_NAME="Modrinth Enhanced" GIT_AUTHOR_EMAIL="patches@modrinth-enhanced.invalid"
+  export GIT_COMMITTER_NAME="$GIT_AUTHOR_NAME" GIT_COMMITTER_EMAIL="$GIT_AUTHOR_EMAIL"
+
+  rm -rf app
+  mkdir app
+  cd app
+  git init -q
+  # reset --hard checks the tree out again with upstream's .gitattributes
+  # applied, as a clone of the tag would have it
+  bsdtar -xf "$srcdir/modrinth-code-${_base}.tar.gz" --strip-components 1
+  git add -Af
+  git commit -qm "Modrinth App ${_base}"
+  git reset -q --hard
+  git tag base
+  if [[ "$_base" != "$_upstream" ]]; then
+    git rm -rqf .
+    bsdtar -xf "$srcdir/modrinth-code-${_upstream}.tar.gz" --strip-components 1
+    git add -Af
+    git commit -qm "Modrinth App ${_upstream}"
+    git reset -q --hard
+    git tag upstream
+    git checkout -q -b enhanced base
+  fi
+  git am -q --3way --whitespace=nowarn "$srcdir/modrinth-enhanced/patches/"*.patch
+  if [[ "$_base" != "$_upstream" ]]; then
+    git rebase -q --onto upstream base enhanced
+  fi
+
+  # upstream's scripts/set-version.sh: the sources carry 1.0.0-local, the app
+  # reports the Modrinth App release it is built on
+  sed -i "s/1.0.0-local/${_upstream#v}/" \
+    apps/app/Cargo.toml packages/app-lib/Cargo.toml apps/app-frontend/package.json Cargo.lock
+
+  # the production API endpoints, as upstream's scripts/build.sh selects them
+  cp packages/app-lib/.env.prod packages/app-lib/.env
+
+  # node-gyp for the native modules
+  export NODE_PATH=/usr/lib/node_modules
+  export TURBO_TELEMETRY_DISABLED=1
+  pnpm install --frozen-lockfile
+
+  export RUSTUP_TOOLCHAIN=stable
+  cargo fetch --locked --target host-tuple
+}
+
+build() {
+  # GLib for its headers only: the shim looks GTK and GLib up at run time
+  gcc $CPPFLAGS $CFLAGS $LDFLAGS -shared -fPIC -o libwebkit-vblank-shim.so vblank-shim.c \
+    $(pkg-config --cflags glib-2.0) $(pkg-config --cflags --libs libdrm)
+
+  cd app
+
+  export RUSTUP_TOOLCHAIN=stable
+  export NODE_PATH=/usr/lib/node_modules
+  export TURBO_TELEMETRY_DISABLED=1
+  export JAVA_HOME=/usr/lib/jvm/java-17-openjdk
+  # keep Gradle's cache inside the build tree instead of ~/.gradle
+  export GRADLE_USER_HOME="$srcdir/gradle-home"
+
+  # Without tauri-release.conf.json, as upstream builds it: that config only
+  # adds Modrinth's own updater. app-lib's build script runs Gradle, which
+  # downloads itself and the agent's dependencies, so build() needs network.
+  pnpm --filter=@modrinth/app run tauri build --no-bundle
+}
+
+package() {
+  cd app
+
+  # the same files, under the same names, as modrinth-enhanced-bin: the binary
+  # sits behind the script that preloads the shim
+  install -Dm755 target/release/ModrinthEnhanced -t "$pkgdir/usr/lib/modrinth-enhanced/"
+  install -Dm755 "$srcdir/libwebkit-vblank-shim.so" -t "$pkgdir/usr/lib/modrinth-enhanced/"
+  install -Dm755 "$srcdir/modrinth-enhanced.sh" "$pkgdir/usr/bin/ModrinthEnhanced"
+  ln -s ModrinthEnhanced "$pkgdir/usr/bin/modrinth-enhanced"
+
+  install -Dm644 apps/app/icons/128x128.png \
+    "$pkgdir/usr/share/icons/hicolor/128x128/apps/ModrinthEnhanced.png"
+  install -Dm644 apps/app/icons/128x128@2x.png \
+    "$pkgdir/usr/share/icons/hicolor/256x256@2/apps/ModrinthEnhanced.png"
+
+  install -d "$pkgdir/usr/share/applications"
+  cat > "$pkgdir/usr/share/applications/Modrinth Enhanced.desktop" << EOF
+[Desktop Entry]
+Categories=Game;
+Exec=ModrinthEnhanced
+Icon=ModrinthEnhanced
+Name=Modrinth Enhanced
+Terminal=false
+Type=Application
+MimeType=application/x-modrinth-modpack+zip;x-scheme-handler/modrinth
+EOF
+}

modrinth-enhanced/modrinth-enhanced.sh

@@ -0,0 +1 @@
+../modrinth-enhanced-bin/modrinth-enhanced.sh

modrinth-enhanced/pkg.sh

@@ -0,0 +1,72 @@
+# modrinth-enhanced - Modrinth Enhanced (https://git.felo.gg/Felitendo/Modrinth-Enhanced),
+# the Modrinth App (Tauri) with a series of patches applied: no ads, no
+# telemetry, offline and Ely.by accounts, Linux fixes.
+#
+# Source package: upstream is not a fork but a patch series on top of a
+# modrinth/code release tag. The PKGBUILD takes the patches from the Modrinth
+# Enhanced release tag, applies them to the modrinth/code tarballs the same way
+# upstream's scripts/prepare.sh does and builds the result like
+# scripts/build.sh - the binary upstream wraps into the .deb that
+# modrinth-enhanced-bin repackages.
+#
+# Two modrinth/code releases are pinned per version, both read from the
+# release tag: upstream.txt is the release it was built on, patches/base.txt
+# the one the patches were last exported against. They differ until the
+# patches are exported again after Modrinth ships a release; the PKGBUILD then
+# downloads both and rebases the patches from one onto the other.
+#
+# Release/version handling is identical to modrinth-enhanced-bin: a revision
+# of the patches is tagged v0.21.2-2 and becomes pkgver 0.21.2.r2. See
+# modrinth-enhanced-bin/pkg.sh.
+
+UPSTREAM_REPO="Felitendo/Modrinth-Enhanced"
+
+# Installed in CI (pacman) before the makepkg test build. makepkg runs with
+# -d there, so the libraries the binary links against are listed too.
+BUILD_DEPS=(rust git jdk17-openjdk node-gyp nodejs npm pnpm webkit2gtk-4.1 gtk3 libsoup3 libdrm)
+
+latest_version() {
+  curl -sf "https://git.felo.gg/api/v1/repos/$UPSTREAM_REPO/releases/latest" \
+    | jq -r '.tag_name' | sed 's/^v//; s/-/.r/'
+}
+
+# read_tag_file <tag> <path> - a file of the release tag, whitespace stripped
+read_tag_file() {
+  curl -sf "https://git.felo.gg/$UPSTREAM_REPO/raw/tag/$1/$2" \
+    | tr -d '[:space:]'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local tag="v${ver/.r/-}" upstream base sha_patches sha_upstream sums
+
+  upstream="$(read_tag_file "$tag" upstream.txt)"
+  # like upstream's patch_base(): without base.txt the patches fit upstream.txt
+  base="$(read_tag_file "$tag" patches/base.txt)" || base="$upstream"
+  if [[ ! "$upstream" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ || ! "$base" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    echo "could not resolve the Modrinth App releases of $tag (upstream: $upstream, base: $base)" >&2
+    return 1
+  fi
+
+  sha_patches="$(curl -sfL "https://git.felo.gg/$UPSTREAM_REPO/archive/$tag.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+  sha_upstream="$(curl -sfL "https://github.com/modrinth/code/archive/refs/tags/$upstream.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+  # vblank-shim.c and modrinth-enhanced.sh ship with the package, as symlinks
+  # to modrinth-enhanced-bin's copies; they come before the optional base tag
+  sums="'$sha_patches' '$sha_upstream'"
+  sums+=" '$(sha256sum "$(dirname "$pkgbuild")/vblank-shim.c" | cut -d' ' -f1)'"
+  sums+=" '$(sha256sum "$(dirname "$pkgbuild")/modrinth-enhanced.sh" | cut -d' ' -f1)'"
+  if [[ "$base" != "$upstream" ]]; then
+    sums+=" '$(curl -sfL "https://github.com/modrinth/code/archive/refs/tags/$base.tar.gz" \
+      | sha256sum | cut -d' ' -f1)'"
+  fi
+
+  sed -i \
+    -e "s|^_tag=.*|_tag=\"$tag\"|" \
+    -e "s|^_upstream=.*|_upstream=\"$upstream\"|" \
+    -e "s|^_base=.*|_base=\"$base\"|" \
+    -e "s|^sha256sums=.*|sha256sums=($sums)|" \
+    "$pkgbuild"
+}

modrinth-enhanced/vblank-shim.c

@@ -0,0 +1 @@
+../modrinth-enhanced-bin/vblank-shim.c

moondeckbuddy-bin/.SRCINFO

@@ -0,0 +1,32 @@
+pkgbase = moondeckbuddy-bin
+	pkgdesc = Host companion that lets the MoonDeck Steam Deck plugin control Steam and the PC (upstream AppImage)
+	pkgver = 1.10.0
+	pkgrel = 1
+	url = https://github.com/FrogTheFrog/moondeck-buddy
+	arch = x86_64
+	license = LGPL-3.0-only
+	depends = bash
+	depends = e2fsprogs
+	depends = fontconfig
+	depends = freetype2
+	depends = glibc
+	depends = hicolor-icon-theme
+	depends = libgcc
+	depends = libglvnd
+	depends = libgpg-error
+	depends = libstdc++
+	depends = libx11
+	depends = libxcb
+	depends = zlib
+	provides = moondeckbuddy
+	conflicts = moondeckbuddy
+	conflicts = moondeckbuddy-appimage
+	noextract = moondeckbuddy-bin-1.10.0.AppImage
+	options = !strip
+	options = !debug
+	source = moondeckbuddy-bin-1.10.0.AppImage::https://github.com/FrogTheFrog/moondeck-buddy/releases/download/v1.10.0/MoonDeckBuddy-1.10.0-x86_64.AppImage
+	source = LICENSE-1.10.0::https://raw.githubusercontent.com/FrogTheFrog/moondeck-buddy/v1.10.0/LICENSE
+	sha256sums = 51960ec27f897818e10f6e06a3c8994eebfd05c58c9c51ed89cad5b53caa5a46
+	sha256sums = a5681bf9b05db14d86776930017c647ad9e6e56ff6bbcfdf21e5848288dfaf1b
+
+pkgname = moondeckbuddy-bin

moondeckbuddy-bin/PKGBUILD

@@ -0,0 +1,68 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=moondeckbuddy-bin
+pkgver=1.10.0
+pkgrel=1
+pkgdesc="Host companion that lets the MoonDeck Steam Deck plugin control Steam and the PC (upstream AppImage)"
+arch=('x86_64')
+url="https://github.com/FrogTheFrog/moondeck-buddy"
+license=('LGPL-3.0-only')
+# the AppImage bundles Qt6, OpenSSL, glib, libproc2 and the xcb stack; these
+# are what is left over (bash runs upstream's AppRun)
+depends=('bash' 'e2fsprogs' 'fontconfig' 'freetype2' 'glibc'
+         'hicolor-icon-theme' 'libgcc' 'libglvnd' 'libgpg-error' 'libstdc++'
+         'libx11' 'libxcb' 'zlib')
+provides=('moondeckbuddy')
+conflicts=('moondeckbuddy' 'moondeckbuddy-appimage')
+options=('!strip' '!debug')
+source=("${pkgname}-${pkgver}.AppImage::https://github.com/FrogTheFrog/moondeck-buddy/releases/download/v${pkgver}/MoonDeckBuddy-${pkgver}-x86_64.AppImage"
+        "LICENSE-${pkgver}::https://raw.githubusercontent.com/FrogTheFrog/moondeck-buddy/v${pkgver}/LICENSE")
+noextract=("${pkgname}-${pkgver}.AppImage")
+sha256sums=('51960ec27f897818e10f6e06a3c8994eebfd05c58c9c51ed89cad5b53caa5a46' 'a5681bf9b05db14d86776930017c647ad9e6e56ff6bbcfdf21e5848288dfaf1b')
+
+prepare() {
+  chmod +x "$srcdir/${pkgname}-${pkgver}.AppImage"
+  "$srcdir/${pkgname}-${pkgver}.AppImage" --appimage-extract > /dev/null
+}
+
+package() {
+  local _root="$srcdir/squashfs-root"
+
+  # upstream's AppImage payload, installed unchanged apart from the top-level
+  # icon/desktop symlinks only the AppImage runtime uses
+  install -d "$pkgdir/opt/$pkgname"
+  cp -a "$_root/." "$pkgdir/opt/$pkgname/"
+  rm -f "$pkgdir/opt/$pkgname/"{.DirIcon,MoonDeckBuddy.desktop,moondeckbuddy.png}
+  # the bundled libraries' copyright files are world-writable in the image,
+  # and linuxdeploy leaves a few empty directories behind
+  chmod -R go-w "$pkgdir/opt/$pkgname"
+  find "$pkgdir/opt/$pkgname" -type d -empty -delete
+
+  # The AppRun forces the bundled xcb platform plugin (there is no Wayland one
+  # in the bundle), so the binaries go through it. Buddy writes its own path
+  # into the autostart entry and systemd user service it creates and takes it
+  # from $APPIMAGE when set - pointing that at the wrapper keeps autostart on
+  # the AppRun too, just as the AppRun does with the AppImage's own path.
+  install -d "$pkgdir/usr/bin"
+  local _bin
+  for _bin in MoonDeckBuddy MoonDeckStream; do
+    cat > "$pkgdir/usr/bin/$_bin" << EOF
+#!/bin/sh
+APPIMAGE=/usr/bin/$_bin exec /opt/$pkgname/AppRun --exec $_bin "\$@"
+EOF
+    chmod 755 "$pkgdir/usr/bin/$_bin"
+  done
+
+  install -Dm644 "$_root/usr/share/applications/MoonDeckBuddy.desktop" \
+    "$pkgdir/usr/share/applications/MoonDeckBuddy.desktop"
+  local _size
+  for _size in 16 32 64 128 256; do
+    install -Dm644 "$_root/usr/share/icons/hicolor/${_size}x${_size}/apps/moondeckbuddy.png" \
+      "$pkgdir/usr/share/icons/hicolor/${_size}x${_size}/apps/moondeckbuddy.png"
+  done
+
+  install -Dm644 "$srcdir/LICENSE-${pkgver}" \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}

moondeckbuddy-bin/pkg.sh

@@ -0,0 +1,35 @@
+# moondeckbuddy-bin - MoonDeck Buddy (https://github.com/FrogTheFrog/moondeck-buddy),
+# the host-side companion of the MoonDeck Steam Deck plugin (C++23 + Qt6).
+#
+# Upstream publishes a linuxdeploy AppImage per release, which the PKGBUILD
+# unpacks into /opt - so there is no build step here, only pkgver and the
+# checksums are refreshed on a new version. The license text is not part of
+# the AppImage and comes from the matching source tag.
+#
+# Releases are created as drafts by upstream's CI and published by hand, so
+# /releases/latest never points at a release whose assets are still missing.
+
+UPSTREAM_REPO="FrogTheFrog/moondeck-buddy"
+
+# The AUR already carries moondeckbuddy-appimage, which ships the same upstream
+# AppImage, so publishing this as well would be a second copy of one package.
+# Flip this to true to publish; until then the PKGBUILD is still kept current
+# and test-built here.
+AUR_PUBLISH=false
+
+latest_version() {
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' | sed 's/^v//'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local sha_img sha_lic
+
+  sha_img="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/v$ver/MoonDeckBuddy-$ver-x86_64.AppImage" \
+    | sha256sum | cut -d' ' -f1)"
+  sha_lic="$(curl -sfL "https://raw.githubusercontent.com/$UPSTREAM_REPO/v$ver/LICENSE" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i "s|^sha256sums=.*|sha256sums=('$sha_img' '$sha_lic')|" "$pkgbuild"
+}

moondeckbuddy/.SRCINFO

@@ -0,0 +1,27 @@
+pkgbase = moondeckbuddy
+	pkgdesc = Host companion that lets the MoonDeck Steam Deck plugin control Steam and the PC
+	pkgver = 1.10.0
+	pkgrel = 1
+	url = https://github.com/FrogTheFrog/moondeck-buddy
+	arch = x86_64
+	license = LGPL-3.0-only
+	license = MIT
+	makedepends = cmake
+	makedepends = ninja
+	depends = glibc
+	depends = hicolor-icon-theme
+	depends = libgcc
+	depends = libstdc++
+	depends = procps-ng
+	depends = qt6-base
+	depends = qt6-httpserver
+	depends = qt6-websockets
+	conflicts = moondeckbuddy-appimage
+	source = moondeckbuddy-1.10.0.tar.gz::https://github.com/FrogTheFrog/moondeck-buddy/archive/refs/tags/v1.10.0.tar.gz
+	source = moondeck-keys-9d1cc7356181f6f6c0aa2a5e92ad7174f09fa539.tar.gz::https://github.com/FrogTheFrog/moondeck-keys/archive/9d1cc7356181f6f6c0aa2a5e92ad7174f09fa539.tar.gz
+	source = glaze-7.7.1.tar.gz::https://github.com/stephenberry/glaze/archive/refs/tags/v7.7.1.tar.gz
+	sha256sums = f68aff3e26c51618bd78e7656cfe3481fd0c4d2be377a26fc4e5db54e9541642
+	sha256sums = 80438b7cec54f89e3b03ad4bf1bf46edd36a8438e5ebcdb5333ecacd45aba7cc
+	sha256sums = c51217ca374f2a7d556c501a849d3a43dfffff47ba7711b6f0c22020e71ff63d
+
+pkgname = moondeckbuddy

moondeckbuddy/PKGBUILD

@@ -0,0 +1,55 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=moondeckbuddy
+pkgver=1.10.0
+pkgrel=1
+pkgdesc="Host companion that lets the MoonDeck Steam Deck plugin control Steam and the PC"
+arch=('x86_64')
+url="https://github.com/FrogTheFrog/moondeck-buddy"
+# MIT: glaze, a header-only JSON library compiled into both binaries
+license=('LGPL-3.0-only' 'MIT')
+depends=('glibc' 'hicolor-icon-theme' 'libgcc' 'libstdc++' 'procps-ng'
+         'qt6-base' 'qt6-httpserver' 'qt6-websockets')
+makedepends=('cmake' 'ninja')
+conflicts=('moondeckbuddy-appimage')
+# The tag tarball carries neither the resources/ssl submodule (the self-signed
+# certificate Buddy and MoonDeck share) nor glaze, which CMake would fetch at
+# configure time. Both are pinned to what the tag references; see pkg.sh.
+_keys_commit="9d1cc7356181f6f6c0aa2a5e92ad7174f09fa539"
+_glaze_ver="7.7.1"
+source=("${pkgname}-${pkgver}.tar.gz::https://github.com/FrogTheFrog/moondeck-buddy/archive/refs/tags/v${pkgver}.tar.gz"
+        "moondeck-keys-${_keys_commit}.tar.gz::https://github.com/FrogTheFrog/moondeck-keys/archive/${_keys_commit}.tar.gz"
+        "glaze-${_glaze_ver}.tar.gz::https://github.com/stephenberry/glaze/archive/refs/tags/v${_glaze_ver}.tar.gz")
+sha256sums=('f68aff3e26c51618bd78e7656cfe3481fd0c4d2be377a26fc4e5db54e9541642' '80438b7cec54f89e3b03ad4bf1bf46edd36a8438e5ebcdb5333ecacd45aba7cc' 'c51217ca374f2a7d556c501a849d3a43dfffff47ba7711b6f0c22020e71ff63d')
+
+prepare() {
+  cd "moondeck-buddy-${pkgver}"
+
+  rm -rf resources/ssl
+  ln -s "$srcdir/moondeck-keys-${_keys_commit}" resources/ssl
+
+  # upstream builds with -Werror against GCC 13 and Qt 6.8; warnings that a
+  # newer toolchain adds must not fail the package build
+  sed -i 's/ -Werror)/)/' CMakeLists.txt
+}
+
+build() {
+  cmake -B build -S "moondeck-buddy-${pkgver}" -G Ninja \
+    -DCMAKE_BUILD_TYPE=None \
+    -DCMAKE_INSTALL_PREFIX=/usr \
+    -DFETCHCONTENT_FULLY_DISCONNECTED=ON \
+    -DFETCHCONTENT_SOURCE_DIR_GLAZE="$srcdir/glaze-${_glaze_ver}"
+  cmake --build build
+}
+
+package() {
+  # both binaries, the desktop entry and the icons
+  DESTDIR="$pkgdir" cmake --install build
+
+  install -Dm644 "moondeck-buddy-${pkgver}/LICENSE" \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 "glaze-${_glaze_ver}/LICENSE" \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.glaze"
+}

moondeckbuddy/pkg.sh

@@ -0,0 +1,54 @@
+# moondeckbuddy - MoonDeck Buddy (https://github.com/FrogTheFrog/moondeck-buddy),
+# the host-side companion of the MoonDeck Steam Deck plugin (C++23 + Qt6).
+#
+# Source package: the PKGBUILD builds the release tag against Arch's Qt6 - the
+# same CMake project upstream hands to linuxdeploy for the AppImage that
+# moondeckbuddy-bin repackages.
+#
+# The tag tarball lacks two inputs of the build, both pinned per release:
+# - resources/ssl is a git submodule (FrogTheFrog/moondeck-keys) holding the
+#   self-signed certificate compiled into Buddy; its commit is read from the
+#   tag's tree.
+# - glaze is pulled by src/lib/json/CMakeLists.txt with FetchContent at
+#   configure time; its GIT_TAG is read from that file, and the PKGBUILD points
+#   FETCHCONTENT_SOURCE_DIR_GLAZE at the matching tarball so build() needs no
+#   network.
+#
+# Releases are created as drafts by upstream's CI and published by hand, so
+# /releases/latest never points at a half-finished release.
+
+UPSTREAM_REPO="FrogTheFrog/moondeck-buddy"
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(cmake ninja procps-ng qt6-base qt6-httpserver qt6-websockets)
+
+latest_version() {
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' | sed 's/^v//'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local keys glaze sha_src sha_keys sha_glaze
+
+  keys="$(gh api "repos/$UPSTREAM_REPO/contents/resources/ssl?ref=v$ver" --jq '.sha')"
+  glaze="$(gh api "repos/$UPSTREAM_REPO/contents/src/lib/json/CMakeLists.txt?ref=v$ver" \
+    -H 'Accept: application/vnd.github.raw' | grep -Po 'GIT_TAG\s+v\K[0-9.]+$')"
+  if [[ ! "$keys" =~ ^[0-9a-f]{40}$ || -z "$glaze" ]]; then
+    echo "could not resolve the moondeck-keys commit ($keys) or glaze version ($glaze) of v$ver" >&2
+    return 1
+  fi
+
+  sha_src="$(curl -sfL "https://github.com/$UPSTREAM_REPO/archive/refs/tags/v$ver.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+  sha_keys="$(curl -sfL "https://github.com/FrogTheFrog/moondeck-keys/archive/$keys.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+  sha_glaze="$(curl -sfL "https://github.com/stephenberry/glaze/archive/refs/tags/v$glaze.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i \
+    -e "s|^_keys_commit=.*|_keys_commit=\"$keys\"|" \
+    -e "s|^_glaze_ver=.*|_glaze_ver=\"$glaze\"|" \
+    -e "s|^sha256sums=.*|sha256sums=('$sha_src' '$sha_keys' '$sha_glaze')|" \
+    "$pkgbuild"
+}

moonlight-vrr-bin/.SRCINFO

@@ -0,0 +1,36 @@
+pkgbase = moonlight-vrr-bin
+	pkgdesc = GameStream client for PCs, fork of moonlight-qt with smooth VRR pacing (upstream AppImage)
+	pkgver = 6.1.0_vrr18
+	pkgrel = 1
+	url = https://github.com/Nonary/moonlight-qt
+	arch = x86_64
+	license = GPL-3.0-or-later
+	depends = e2fsprogs
+	depends = fontconfig
+	depends = freetype2
+	depends = glibc
+	depends = harfbuzz
+	depends = hicolor-icon-theme
+	depends = libdrm
+	depends = libgcc
+	depends = libglvnd
+	depends = libgpg-error
+	depends = libice
+	depends = libsm
+	depends = libstdc++
+	depends = libx11
+	depends = libxcb
+	depends = zlib
+	optdepends = libva-intel-driver: hardware acceleration for Intel GPUs up to Coffee Lake
+	optdepends = intel-media-driver: hardware acceleration for Intel GPUs from Broadwell on
+	provides = moonlight-vrr
+	provides = moonlight-qt
+	conflicts = moonlight-vrr
+	conflicts = moonlight-qt
+	noextract = moonlight-vrr-bin-6.1.0_vrr18.AppImage
+	options = !strip
+	options = !debug
+	source = moonlight-vrr-bin-6.1.0_vrr18.AppImage::https://github.com/Nonary/moonlight-qt/releases/download/v6.1.0-vrr18/Moonlight-6.1.0-vrr18-x86_64.AppImage
+	sha256sums = 5b5992eb0d9d6528ca6db83c33da3bf6cbecea0f5a8f7b9b34dcd5d22d13f40c
+
+pkgname = moonlight-vrr-bin

moonlight-vrr-bin/PKGBUILD

@@ -0,0 +1,58 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=moonlight-vrr-bin
+pkgver=6.1.0_vrr18
+pkgrel=1
+pkgdesc="GameStream client for PCs, fork of moonlight-qt with smooth VRR pacing (upstream AppImage)"
+arch=('x86_64')
+url="https://github.com/Nonary/moonlight-qt"
+license=('GPL-3.0-or-later')
+# the AppImage bundles Qt6, FFmpeg, SDL, libplacebo and the rest of the stack;
+# these are what is left over
+depends=('e2fsprogs' 'fontconfig' 'freetype2' 'glibc' 'harfbuzz'
+         'hicolor-icon-theme' 'libdrm' 'libgcc' 'libglvnd' 'libgpg-error' 'libice'
+         'libsm' 'libstdc++' 'libx11' 'libxcb' 'zlib')
+optdepends=('libva-intel-driver: hardware acceleration for Intel GPUs up to Coffee Lake'
+            'intel-media-driver: hardware acceleration for Intel GPUs from Broadwell on')
+provides=('moonlight-vrr' 'moonlight-qt')
+conflicts=('moonlight-vrr' 'moonlight-qt')
+options=('!strip' '!debug')
+# upstream tags use hyphens (v6.1.0-vrr18), which pkgver must not contain
+_upver="${pkgver//_/-}"
+source=("${pkgname}-${pkgver}.AppImage::${url}/releases/download/v${_upver}/Moonlight-${_upver}-x86_64.AppImage")
+noextract=("${pkgname}-${pkgver}.AppImage")
+sha256sums=('5b5992eb0d9d6528ca6db83c33da3bf6cbecea0f5a8f7b9b34dcd5d22d13f40c')
+
+prepare() {
+  chmod +x "$srcdir/${pkgname}-${pkgver}.AppImage"
+  "$srcdir/${pkgname}-${pkgver}.AppImage" --appimage-extract > /dev/null
+}
+
+package() {
+  local _root="$srcdir/squashfs-root"
+
+  # upstream's AppImage payload, installed unchanged
+  install -d "$pkgdir/opt/$pkgname"
+  cp -a "$_root/usr/." "$pkgdir/opt/$pkgname/"
+  # the squashfs has private directories and world writable files
+  chmod -R u=rwX,go=rX "$pkgdir/opt/$pkgname"
+
+  # the binary has a RUNPATH into the bundle and reads the qt.conf next to it,
+  # so it has to be exec'd where it is
+  install -d "$pkgdir/usr/bin"
+  cat > "$pkgdir/usr/bin/moonlight" << EOF
+#!/bin/sh
+exec /opt/$pkgname/bin/moonlight "\$@"
+EOF
+  chmod 755 "$pkgdir/usr/bin/moonlight"
+
+  install -Dm644 "$_root/com.moonlight_stream.Moonlight.desktop" \
+    "$pkgdir/usr/share/applications/com.moonlight_stream.Moonlight.desktop"
+  sed -i '/^X-AppImage-/d' "$pkgdir/usr/share/applications/com.moonlight_stream.Moonlight.desktop"
+  install -Dm644 "$_root/usr/share/metainfo/com.moonlight_stream.Moonlight.appdata.xml" \
+    "$pkgdir/usr/share/metainfo/com.moonlight_stream.Moonlight.appdata.xml"
+  install -Dm644 "$_root/usr/share/icons/hicolor/scalable/apps/moonlight.svg" \
+    "$pkgdir/usr/share/icons/hicolor/scalable/apps/moonlight.svg"
+}

moonlight-vrr-bin/pkg.sh

@@ -0,0 +1,34 @@
+# moonlight-vrr-bin - Nonary's fork of Moonlight (https://github.com/Nonary/moonlight-qt),
+# the GameStream client for PCs, with smooth VRR frame pacing (C++ + Qt6).
+#
+# Upstream publishes an AppImage per release, which the PKGBUILD unpacks and
+# installs into /opt, so there is no build step here. GitHub lists each
+# asset's sha256, so a new version needs no download. Upstream builds the
+# AppImage without Wayland support, it runs through XWayland.
+#
+# Version handling is the same as in moonlight-vrr: tags look like
+# v6.1.0-vrr18, pkgver has an underscore for the hyphen, and /releases/latest
+# skips the betas.
+
+UPSTREAM_REPO="Nonary/moonlight-qt"
+
+latest_version() {
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' \
+    | sed -e 's/^v//' -e 's/-/_/g'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local upver="${ver//_/-}" sha
+
+  sha="$(gh api "repos/$UPSTREAM_REPO/releases/tags/v$upver" \
+    --jq ".assets[] | select(.name == \"Moonlight-$upver-x86_64.AppImage\") | .digest" \
+    | sed 's/^sha256://')"
+  if [[ ! "$sha" =~ ^[0-9a-f]{64}$ ]]; then
+    echo "v$upver has no Moonlight-$upver-x86_64.AppImage with a sha256" >&2
+    return 1
+  fi
+
+  sed -i "s|^sha256sums=.*|sha256sums=('$sha')|" "$pkgbuild"
+}

moonlight-vrr/.SRCINFO

@@ -0,0 +1,46 @@
+pkgbase = moonlight-vrr
+	pkgdesc = GameStream client for PCs, fork of moonlight-qt with smooth VRR pacing
+	pkgver = 6.1.0_vrr18
+	pkgrel = 1
+	url = https://github.com/Nonary/moonlight-qt
+	arch = x86_64
+	license = GPL-3.0-or-later
+	makedepends = vulkan-headers
+	depends = ffmpeg
+	depends = glibc
+	depends = hicolor-icon-theme
+	depends = libdrm
+	depends = libgcc
+	depends = libglvnd
+	depends = libplacebo
+	depends = libstdc++
+	depends = libva
+	depends = libx11
+	depends = openssl
+	depends = opus
+	depends = qt6-base
+	depends = qt6-declarative
+	depends = qt6-svg
+	depends = sdl2-compat
+	depends = sdl2_ttf
+	depends = wayland
+	optdepends = libva-intel-driver: hardware acceleration for Intel GPUs up to Coffee Lake
+	optdepends = intel-media-driver: hardware acceleration for Intel GPUs from Broadwell on
+	provides = moonlight-qt
+	conflicts = moonlight-qt
+	source = moonlight-vrr-6.1.0_vrr18.tar.gz::https://github.com/Nonary/moonlight-qt/archive/refs/tags/v6.1.0-vrr18.tar.gz
+	source = moonlight-common-c-d6a11bc685b41037b352a96f29d08276fe5359ba.tar.gz::https://github.com/Nonary/moonlight-common-c/archive/d6a11bc685b41037b352a96f29d08276fe5359ba.tar.gz
+	source = enet-aca87840b57f045a1f7f9299e4b1b9b8e2a5e2f1.tar.gz::https://github.com/cgutman/enet/archive/aca87840b57f045a1f7f9299e4b1b9b8e2a5e2f1.tar.gz
+	source = nanors-b1e3c22ca0cdc0bb83e3cd6ed1a2fc77869ed99a.tar.gz::https://github.com/sleepybishop/nanors/archive/b1e3c22ca0cdc0bb83e3cd6ed1a2fc77869ed99a.tar.gz
+	source = qmdnsengine-920c097ffa742e2968290f15d4dde6693aec02e5.tar.gz::https://github.com/cgutman/qmdnsengine/archive/920c097ffa742e2968290f15d4dde6693aec02e5.tar.gz
+	source = SDL_GameControllerDB-8d9fefd7b810f2541f78cc7a8ccbd185bc84c7a5.tar.gz::https://github.com/gabomdq/SDL_GameControllerDB/archive/8d9fefd7b810f2541f78cc7a8ccbd185bc84c7a5.tar.gz
+	source = h264bitstream-34f3c58afa3c47b6cf0a49308a68cbf89c5e0bff.tar.gz::https://github.com/aizvorski/h264bitstream/archive/34f3c58afa3c47b6cf0a49308a68cbf89c5e0bff.tar.gz
+	sha256sums = c5daa59fe3ec058500f57fbae61a3c6697d020a2c3649f36cd2232ea7e999bff
+	sha256sums = 55e62d1735f6e676193d792077c732edb4b467fcff1f4d3bf36ea75be030aca2
+	sha256sums = 6bb1a151e6d21e1756baeff5a95eaf85a5b6731aeda6d0bc255651192ba4a32d
+	sha256sums = 41edc0309b255b0eeb5e8eb1ad79f7c7e9e6c31db1bd79a16d73271c62867003
+	sha256sums = f12236ff3ebce99adb083434756ca17aaf845f11248d2eeb9e68c530304e0299
+	sha256sums = e260456d9c7bdff5f2f8a0db0f772316b44d3e4f7833f72ff8328e95b30eb0ec
+	sha256sums = 04fdcd690de01fa29221f65431f93dc156db146dbaf9e0c27346f3e0cee1a193
+
+pkgname = moonlight-vrr

moonlight-vrr/PKGBUILD

@@ -0,0 +1,70 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=moonlight-vrr
+pkgver=6.1.0_vrr18
+pkgrel=1
+pkgdesc="GameStream client for PCs, fork of moonlight-qt with smooth VRR pacing"
+arch=('x86_64')
+url="https://github.com/Nonary/moonlight-qt"
+license=('GPL-3.0-or-later')
+depends=('ffmpeg' 'glibc' 'hicolor-icon-theme' 'libdrm' 'libgcc' 'libglvnd' 'libplacebo'
+         'libstdc++' 'libva' 'libx11' 'openssl' 'opus' 'qt6-base' 'qt6-declarative'
+         'qt6-svg' 'sdl2-compat' 'sdl2_ttf' 'wayland')
+makedepends=('vulkan-headers')
+optdepends=('libva-intel-driver: hardware acceleration for Intel GPUs up to Coffee Lake'
+            'intel-media-driver: hardware acceleration for Intel GPUs from Broadwell on')
+provides=('moonlight-qt')
+conflicts=('moonlight-qt')
+# upstream tags use hyphens (v6.1.0-vrr18), which pkgver must not contain
+_upver="${pkgver//_/-}"
+# The tag tarball has none of the git submodules. Each is pinned to the commit
+# the tag references, synced by pkg.sh. enet and nanors are submodules of
+# moonlight-common-c.
+_common_c="d6a11bc685b41037b352a96f29d08276fe5359ba"
+_enet="aca87840b57f045a1f7f9299e4b1b9b8e2a5e2f1"
+_nanors="b1e3c22ca0cdc0bb83e3cd6ed1a2fc77869ed99a"
+_qmdnsengine="920c097ffa742e2968290f15d4dde6693aec02e5"
+_gamecontrollerdb="8d9fefd7b810f2541f78cc7a8ccbd185bc84c7a5"
+_h264bitstream="34f3c58afa3c47b6cf0a49308a68cbf89c5e0bff"
+source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${_upver}.tar.gz"
+        "moonlight-common-c-${_common_c}.tar.gz::https://github.com/Nonary/moonlight-common-c/archive/${_common_c}.tar.gz"
+        "enet-${_enet}.tar.gz::https://github.com/cgutman/enet/archive/${_enet}.tar.gz"
+        "nanors-${_nanors}.tar.gz::https://github.com/sleepybishop/nanors/archive/${_nanors}.tar.gz"
+        "qmdnsengine-${_qmdnsengine}.tar.gz::https://github.com/cgutman/qmdnsengine/archive/${_qmdnsengine}.tar.gz"
+        "SDL_GameControllerDB-${_gamecontrollerdb}.tar.gz::https://github.com/gabomdq/SDL_GameControllerDB/archive/${_gamecontrollerdb}.tar.gz"
+        "h264bitstream-${_h264bitstream}.tar.gz::https://github.com/aizvorski/h264bitstream/archive/${_h264bitstream}.tar.gz")
+sha256sums=('c5daa59fe3ec058500f57fbae61a3c6697d020a2c3649f36cd2232ea7e999bff' '55e62d1735f6e676193d792077c732edb4b467fcff1f4d3bf36ea75be030aca2' '6bb1a151e6d21e1756baeff5a95eaf85a5b6731aeda6d0bc255651192ba4a32d' '41edc0309b255b0eeb5e8eb1ad79f7c7e9e6c31db1bd79a16d73271c62867003' 'f12236ff3ebce99adb083434756ca17aaf845f11248d2eeb9e68c530304e0299' 'e260456d9c7bdff5f2f8a0db0f772316b44d3e4f7833f72ff8328e95b30eb0ec' '04fdcd690de01fa29221f65431f93dc156db146dbaf9e0c27346f3e0cee1a193')
+
+# _link <submodule path> <extracted dir>
+_link() {
+  rm -rf "$1"
+  ln -s "$srcdir/$2" "$1"
+}
+
+prepare() {
+  cd "$srcdir/moonlight-common-c-${_common_c}"
+  _link enet "enet-${_enet}"
+  _link nanors "nanors-${_nanors}"
+
+  cd "$srcdir/moonlight-qt-${_upver}"
+  _link moonlight-common-c/moonlight-common-c "moonlight-common-c-${_common_c}"
+  _link qmdnsengine/qmdnsengine "qmdnsengine-${_qmdnsengine}"
+  _link app/SDL_GameControllerDB "SDL_GameControllerDB-${_gamecontrollerdb}"
+  _link h264bitstream/h264bitstream "h264bitstream-${_h264bitstream}"
+}
+
+build() {
+  cd "moonlight-qt-${_upver}"
+
+  # the version the app shows; app/version.txt only has the base version
+  export CI_VERSION="$_upver"
+  qmake6 PREFIX=/usr moonlight-qt.pro
+  make release
+}
+
+package() {
+  cd "moonlight-qt-${_upver}"
+  make INSTALL_ROOT="$pkgdir" install
+}

moonlight-vrr/pkg.sh

@@ -0,0 +1,67 @@
+# moonlight-vrr - Nonary's fork of Moonlight (https://github.com/Nonary/moonlight-qt),
+# the GameStream client for PCs, with smooth VRR frame pacing (C++ + Qt6).
+#
+# Source package: the PKGBUILD builds the release tag against Arch's Qt6 and
+# FFmpeg, as extra/moonlight-qt does for the original. moonlight-vrr-bin
+# repackages the AppImage upstream builds from the same tag.
+#
+# The tag tarball lacks the git submodules. refresh_checksums() reads the
+# commit of each from the tag's tree (enet and nanors from moonlight-common-c)
+# and syncs it into the PKGBUILD. It fails when a submodule moves to another
+# repository.
+#
+# Tags look like v6.1.0-vrr18, pkgver has an underscore for the hyphen.
+# /releases/latest skips the betas, which upstream marks as prereleases.
+
+UPSTREAM_REPO="Nonary/moonlight-qt"
+
+# Installed in CI (pacman) before the makepkg test build: the makedepends plus
+# the libraries the build links against. qmake turns off what it cannot find.
+BUILD_DEPS=(vulkan-headers ffmpeg libdrm libglvnd libplacebo libva libx11 openssl opus
+            qt6-base qt6-declarative qt6-svg sdl2-compat sdl2_ttf wayland)
+
+latest_version() {
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' \
+    | sed -e 's/^v//' -e 's/-/_/g'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local tag="v${ver//_/-}" var parent path repo sha url
+  local -A commit=()
+  local -a sed_args=() sums=()
+
+  sums+=("$(curl -sfL "https://github.com/$UPSTREAM_REPO/archive/refs/tags/$tag.tar.gz" \
+    | sha256sum | cut -d' ' -f1)")
+
+  # <PKGBUILD variable> <repository with the .gitmodules> <path> <repository>,
+  # in the order of source=()
+  while read -r var parent path repo; do
+    read -r sha url < <(gh api "repos/$parent/contents/$path?ref=${commit[$parent]:-$tag}" \
+      --jq 'select(.type == "submodule") | "\(.sha) \(.submodule_git_url)"') || true
+    if [[ ! "$sha" =~ ^[0-9a-f]{40}$ || "${url%.git}" != "https://github.com/$repo" ]]; then
+      echo "$tag: submodule $path is no longer $repo (${url:-not found}), update the PKGBUILD" >&2
+      return 1
+    fi
+    commit[$repo]="$sha"
+    sed_args+=(-e "s|^$var=.*|$var=\"$sha\"|")
+    sums+=("$(curl -sfL "https://github.com/$repo/archive/$sha.tar.gz" | sha256sum | cut -d' ' -f1)")
+  done <<'EOF'
+_common_c Nonary/moonlight-qt moonlight-common-c/moonlight-common-c Nonary/moonlight-common-c
+_enet Nonary/moonlight-common-c enet cgutman/enet
+_nanors Nonary/moonlight-common-c nanors sleepybishop/nanors
+_qmdnsengine Nonary/moonlight-qt qmdnsengine/qmdnsengine cgutman/qmdnsengine
+_gamecontrollerdb Nonary/moonlight-qt app/SDL_GameControllerDB gabomdq/SDL_GameControllerDB
+_h264bitstream Nonary/moonlight-qt h264bitstream/h264bitstream aizvorski/h264bitstream
+EOF
+
+  if [[ " ${sums[*]} " == *" $(printf '' | sha256sum | cut -d' ' -f1) "* ]]; then
+    echo "$tag: could not download every source tarball" >&2
+    return 1
+  fi
+
+  sed -i "${sed_args[@]}" \
+    -e "s|^sha256sums=.*|sha256sums=($(printf "'%s' " "${sums[@]}" | sed 's/ $//'))|" \
+    "$pkgbuild"
+}

nextcloud-native-bin/.SRCINFO

@@ -0,0 +1,43 @@
+pkgbase = nextcloud-native-bin
+	pkgdesc = Adaptive native client for Nextcloud files, media and apps (upstream binary)
+	pkgver = 0.1.0alpha.2
+	pkgrel = 2
+	url = https://nati.ve
+	arch = x86_64
+	license = AGPL-3.0-or-later
+	depends = alsa-lib
+	depends = brotli
+	depends = bzip2
+	depends = expat
+	depends = fontconfig
+	depends = freetype2
+	depends = gcc-libs
+	depends = glibc
+	depends = hicolor-icon-theme
+	depends = libbsd
+	depends = libglvnd
+	depends = libmd
+	depends = libpng
+	depends = libsecret
+	depends = libx11
+	depends = libxau
+	depends = libxcb
+	depends = libxdmcp
+	depends = libxext
+	depends = libxi
+	depends = libxrender
+	depends = libxtst
+	depends = xdg-utils
+	depends = zlib
+	optdepends = gnome-keyring: Secret Service provider for stored accounts
+	optdepends = kwallet: Secret Service provider for stored accounts on Plasma
+	optdepends = fuse2: mount an account as a virtual file system
+	provides = nextcloud-native
+	conflicts = nextcloud-native
+	noextract = nextcloud-native-bin-0.1.0alpha.2.deb
+	options = !strip
+	options = !debug
+	source = nextcloud-native-bin-0.1.0alpha.2.deb::https://github.com/Obiente/native/releases/download/v0.1.0-alpha.2/nextcloudnative_1.0.3822_amd64.deb
+	sha256sums = df8e3e616c79c4ce3f7597fa9b88c188a956475f2af4128bc7a70692ebf39325
+
+pkgname = nextcloud-native-bin

nextcloud-native-bin/PKGBUILD

@@ -0,0 +1,51 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=nextcloud-native-bin
+pkgver=0.1.0alpha.2
+pkgrel=2
+pkgdesc="Adaptive native client for Nextcloud files, media and apps (upstream binary)"
+arch=('x86_64')
+url="https://nati.ve"
+license=('AGPL-3.0-or-later')
+# jpackage bundles its own Java runtime, so these are the shared libraries the
+# upstream .deb declares plus libsecret, whose secret-tool the client calls to
+# store account credentials in the Secret Service.
+depends=('alsa-lib' 'brotli' 'bzip2' 'expat' 'fontconfig' 'freetype2'
+         'gcc-libs' 'glibc' 'hicolor-icon-theme' 'libbsd' 'libglvnd' 'libmd'
+         'libpng' 'libsecret' 'libx11' 'libxau' 'libxcb' 'libxdmcp' 'libxext'
+         'libxi' 'libxrender' 'libxtst' 'xdg-utils' 'zlib')
+optdepends=('gnome-keyring: Secret Service provider for stored accounts'
+            'kwallet: Secret Service provider for stored accounts on Plasma'
+            'fuse2: mount an account as a virtual file system')
+provides=('nextcloud-native')
+conflicts=('nextcloud-native')
+options=('!strip' '!debug')
+# Upstream has no stable release yet: every release is a prerelease, and the
+# repository also carries per-build nightly-* and rolling channel-* releases.
+# Only the versioned tags are packaged, and their asset names embed a build
+# number that cannot be derived from pkgver - both are refreshed automatically.
+_tag="v0.1.0-alpha.2"
+_asset="nextcloudnative_1.0.3822_amd64.deb"
+source=("${pkgname}-${pkgver}.deb::https://github.com/Obiente/native/releases/download/${_tag}/${_asset}")
+noextract=("${pkgname}-${pkgver}.deb")
+sha256sums=('df8e3e616c79c4ce3f7597fa9b88c188a956475f2af4128bc7a70692ebf39325')
+
+package() {
+  # jpackage app image (bundled JRE) in /opt plus the desktop entry, icon and
+  # AppStream metadata upstream adds to the .deb
+  bsdtar -xOf "$srcdir/${pkgname}-${pkgver}.deb" 'data.tar.*' \
+    | bsdtar -xpf - -C "$pkgdir" --exclude './usr/share/doc' ./opt ./usr
+
+  # the launcher resolves its own directory through /proc/self/exe, so a
+  # symlink into /usr/bin keeps the app image self-contained
+  install -d "$pkgdir/usr/bin"
+  ln -s /opt/nextcloudnative/bin/NextcloudNative "$pkgdir/usr/bin/nextcloud-native"
+
+  install -Dm644 "$pkgdir/opt/nextcloudnative/share/doc/copyright" \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+
+  # The in-app updater only engages where dpkg or rpm reports the package as
+  # installed; on Arch it stays inert and updates come through pacman.
+}

nextcloud-native-bin/pkg.sh

@@ -0,0 +1,60 @@
+# nextcloud-native-bin - Nextcloud Native (https://github.com/Obiente/native),
+# an adaptive native Nextcloud client built with Kotlin/Compose Multiplatform.
+#
+# Upstream publishes a jpackage .deb (and .rpm) per release, so there is no
+# build_artifact() here: on a new version only pkgver, the asset name and the
+# checksum are refreshed and the PKGBUILD repackages the .deb directly.
+#
+# The project has no stable release yet. Every GitHub release is marked
+# prerelease, so /latest is empty, and the release list is dominated by
+# per-build "nightly-*" releases plus the rolling "channel-nightly" /
+# "channel-prerelease" pointers, whose assets change under a fixed name. Only
+# the versioned "v*" tags are packaged; nightlies would push several AUR
+# updates a day and cannot be checksummed reliably.
+#
+# pkgver drops the hyphen from the tag (v0.1.0-alpha.2 -> 0.1.0alpha.2).
+# pacman sorts that older than a later plain 0.1.0 (`vercmp 0.1.0alpha.2 0.1.0`
+# is -1, the trailing alphabetic segment loses), so the prereleases upgrade to
+# the eventual stable release on their own and no epoch is needed.
+
+UPSTREAM_REPO="Obiente/native"
+
+# newest release whose tag looks like a version (skips nightly-*/channel-*)
+latest_tag() {
+  gh api "repos/$UPSTREAM_REPO/releases?per_page=100" \
+    --jq '[.[] | select(.tag_name | test("^v[0-9]"))] | .[0].tag_name'
+}
+
+tag_to_pkgver() {
+  sed 's/^v//; s/-//g'
+}
+
+latest_version() {
+  latest_tag | tag_to_pkgver
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local tag asset sha
+
+  tag="$(latest_tag)"
+  if [[ "$(tag_to_pkgver <<< "$tag")" != "$ver" ]]; then
+    echo "newest versioned release is $tag, not the requested $ver - try again" >&2
+    return 1
+  fi
+
+  # e.g. nextcloudnative_1.0.3822_amd64.deb - the number is a build counter
+  asset="$(gh api "repos/$UPSTREAM_REPO/releases/tags/$tag" --jq '.assets[].name' \
+    | grep -E '^nextcloudnative_.*_amd64\.deb$')"
+  [[ "$(wc -l <<< "$asset")" -eq 1 ]] || { echo "expected exactly one amd64 .deb, got: $asset" >&2; return 1; }
+
+  sha="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/$tag/$asset" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i \
+    -e "s|^_tag=.*|_tag=\"$tag\"|" \
+    -e "s|^_asset=.*|_asset=\"$asset\"|" \
+    -e "s|^sha256sums=.*|sha256sums=('$sha')|" \
+    "$pkgbuild"
+}

nextcloud-native-git/.SRCINFO

@@ -0,0 +1,45 @@
+pkgbase = nextcloud-native-git
+	pkgdesc = Adaptive native client for Nextcloud files, media and apps (git)
+	pkgver = 0.1.0.alpha.2.r31.gdcfde9b
+	pkgrel = 2
+	url = https://nati.ve
+	arch = x86_64
+	license = AGPL-3.0-or-later
+	makedepends = jdk21-openjdk
+	makedepends = python
+	makedepends = git
+	depends = alsa-lib
+	depends = brotli
+	depends = bzip2
+	depends = expat
+	depends = fontconfig
+	depends = freetype2
+	depends = gcc-libs
+	depends = glibc
+	depends = hicolor-icon-theme
+	depends = libbsd
+	depends = libglvnd
+	depends = libmd
+	depends = libpng
+	depends = libsecret
+	depends = libx11
+	depends = libxau
+	depends = libxcb
+	depends = libxdmcp
+	depends = libxext
+	depends = libxi
+	depends = libxrender
+	depends = libxtst
+	depends = xdg-utils
+	depends = zlib
+	optdepends = gnome-keyring: Secret Service provider for stored accounts
+	optdepends = kwallet: Secret Service provider for stored accounts on Plasma
+	optdepends = fuse2: mount an account as a virtual file system
+	provides = nextcloud-native
+	conflicts = nextcloud-native
+	options = !strip
+	options = !debug
+	source = nextcloud-native-git::git+https://github.com/Obiente/native.git
+	sha256sums = SKIP
+
+pkgname = nextcloud-native-git

nextcloud-native-git/PKGBUILD

@@ -0,0 +1,82 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=nextcloud-native-git
+pkgver=0.1.0.alpha.2.r31.gdcfde9b
+pkgrel=2
+pkgdesc="Adaptive native client for Nextcloud files, media and apps (git)"
+arch=('x86_64')
+url="https://nati.ve"
+license=('AGPL-3.0-or-later')
+# createDistributable produces a jpackage application image with its own jlink
+# runtime, so the shared libraries that runtime needs are the only depends.
+depends=('alsa-lib' 'brotli' 'bzip2' 'expat' 'fontconfig' 'freetype2'
+         'gcc-libs' 'glibc' 'hicolor-icon-theme' 'libbsd' 'libglvnd' 'libmd'
+         'libpng' 'libsecret' 'libx11' 'libxau' 'libxcb' 'libxdmcp' 'libxext'
+         'libxi' 'libxrender' 'libxtst' 'xdg-utils' 'zlib')
+# The Android SDK, Rust and Node.js that CONTRIBUTING.md lists are needed for
+# the mobile target, the Windows shell helper and the website. The Linux
+# desktop image builds with JDK 21 alone; python renders the AppStream file.
+makedepends=('jdk21-openjdk' 'python' 'git')
+optdepends=('gnome-keyring: Secret Service provider for stored accounts'
+            'kwallet: Secret Service provider for stored accounts on Plasma'
+            'fuse2: mount an account as a virtual file system')
+options=('!strip' '!debug')
+provides=('nextcloud-native')
+conflicts=('nextcloud-native')
+source=("${pkgname}::git+https://github.com/Obiente/native.git")
+sha256sums=('SKIP')
+
+pkgver() {
+  cd "$pkgname"
+  # nightly-* tags would swallow every describe, so match the version tags only
+  git describe --long --abbrev=7 --match 'v[0-9]*' \
+    | sed 's/^v//; s/\([^-]*-g\)/r\1/; s/-/./g'
+}
+
+build() {
+  cd "$pkgname"
+
+  export JAVA_HOME=/usr/lib/jvm/java-21-openjdk
+  # keep Gradle's cache inside the build tree instead of ~/.gradle
+  export GRADLE_USER_HOME="$srcdir/gradle-home"
+
+  # Gradle resolves the dependency graph from Maven Central and Google's
+  # repository during this step, so build() needs network access.
+  ./gradlew --no-daemon --console=plain :ui:createDistributable
+}
+
+package() {
+  cd "$pkgname"
+
+  install -d "$pkgdir/opt/nextcloudnative"
+  cp -a ui/build/compose/binaries/main/app/NextcloudNative/. \
+    "$pkgdir/opt/nextcloudnative/"
+
+  # the launcher resolves its own directory through /proc/self/exe, so a
+  # symlink into /usr/bin keeps the application image self-contained
+  install -d "$pkgdir/usr/bin"
+  ln -s /opt/nextcloudnative/bin/NextcloudNative "$pkgdir/usr/bin/nextcloud-native"
+
+  # upstream's jpackage template, with the launcher path jpackage would fill in
+  sed "s|^Exec=.*|Exec=/opt/nextcloudnative/bin/NextcloudNative|" \
+    release/linux/jpackage/NextcloudNative.desktop \
+    > "$srcdir/nextcloudnative-NextcloudNative.desktop"
+  install -Dm644 "$srcdir/nextcloudnative-NextcloudNative.desktop" \
+    "$pkgdir/usr/share/applications/nextcloudnative-NextcloudNative.desktop"
+
+  install -Dm644 ui/src/desktopMain/resources/nextcloud-native.png \
+    "$pkgdir/usr/share/icons/hicolor/512x512/apps/dev.obiente.nextcloudnative.png"
+
+  # same renderer the packageDeb path uses, fed from gradle.properties so the
+  # metadata cannot drift away from the tag being built
+  python3 tools/render-linux-appstream-metadata.py \
+    release/linux/dev.obiente.nextcloudnative.metainfo.xml \
+    "$pkgdir/usr/share/metainfo/dev.obiente.nextcloudnative.metainfo.xml" \
+    "$(grep -Po '^ncDesktopPackageVersion=\K.*' gradle.properties)" \
+    "$(grep -Po '^ncVersionName=\K.*' gradle.properties)" \
+    "$(date -u -d "@$SOURCE_DATE_EPOCH" +%F)"
+
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}

nextcloud-native-git/pkg.sh

@@ -0,0 +1,28 @@
+# nextcloud-native-git - Nextcloud Native (https://github.com/Obiente/native)
+# built from the main branch. Same build as nextcloud-native, see that package
+# for why the Linux desktop image needs nothing but JDK 21.
+#
+# VCS packages are not version-tracked here on purpose. The AUR copy of a -git
+# PKGBUILD carries only a snapshot of pkgver; the real version comes from
+# pkgver() when the user builds it. Upstream pushes several times a day, so
+# following main here would mean several AUR pushes a day that change nothing
+# for anyone. latest_version() therefore reports the pkgver that is already in
+# the PKGBUILD, which makes the update run a no-op: the package is rebuilt,
+# re-checked and pushed only when the packaging itself changes.
+#
+# When that happens, makepkg refreshes the pkgver snapshot in the PKGBUILD as
+# part of the test build, so the committed snapshot follows along by itself.
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(jdk21-openjdk python git)
+
+latest_version() {
+  grep -Po '^pkgver=\K.*' "$(dirname "${BASH_SOURCE[0]}")/PKGBUILD"
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+# Unreachable: latest_version() never reports a version other than the current
+# one. The git source carries SKIP checksums, so there would be nothing to do.
+refresh_checksums() {
+  :
+}

nextcloud-native/.SRCINFO

@@ -0,0 +1,42 @@
+pkgbase = nextcloud-native
+	pkgdesc = Adaptive native client for Nextcloud files, media and apps
+	pkgver = 0.1.0alpha.2
+	pkgrel = 2
+	url = https://nati.ve
+	arch = x86_64
+	license = AGPL-3.0-or-later
+	makedepends = jdk21-openjdk
+	makedepends = python
+	depends = alsa-lib
+	depends = brotli
+	depends = bzip2
+	depends = expat
+	depends = fontconfig
+	depends = freetype2
+	depends = gcc-libs
+	depends = glibc
+	depends = hicolor-icon-theme
+	depends = libbsd
+	depends = libglvnd
+	depends = libmd
+	depends = libpng
+	depends = libsecret
+	depends = libx11
+	depends = libxau
+	depends = libxcb
+	depends = libxdmcp
+	depends = libxext
+	depends = libxi
+	depends = libxrender
+	depends = libxtst
+	depends = xdg-utils
+	depends = zlib
+	optdepends = gnome-keyring: Secret Service provider for stored accounts
+	optdepends = kwallet: Secret Service provider for stored accounts on Plasma
+	optdepends = fuse2: mount an account as a virtual file system
+	options = !strip
+	options = !debug
+	source = nextcloud-native-0.1.0alpha.2.tar.gz::https://github.com/Obiente/native/archive/refs/tags/v0.1.0-alpha.2.tar.gz
+	sha256sums = 7df806cfb84c1bc3e3d1ce6c642003a16ed7d607546d89973fba31cd381fd699
+
+pkgname = nextcloud-native

nextcloud-native/PKGBUILD

@@ -0,0 +1,78 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=nextcloud-native
+pkgver=0.1.0alpha.2
+pkgrel=2
+pkgdesc="Adaptive native client for Nextcloud files, media and apps"
+arch=('x86_64')
+url="https://nati.ve"
+license=('AGPL-3.0-or-later')
+# createDistributable produces a jpackage application image with its own jlink
+# runtime, so the shared libraries that runtime needs are the only depends.
+depends=('alsa-lib' 'brotli' 'bzip2' 'expat' 'fontconfig' 'freetype2'
+         'gcc-libs' 'glibc' 'hicolor-icon-theme' 'libbsd' 'libglvnd' 'libmd'
+         'libpng' 'libsecret' 'libx11' 'libxau' 'libxcb' 'libxdmcp' 'libxext'
+         'libxi' 'libxrender' 'libxtst' 'xdg-utils' 'zlib')
+# The Android SDK, Rust and Node.js that CONTRIBUTING.md lists are needed for
+# the mobile target, the Windows shell helper and the website. The Linux
+# desktop image builds with JDK 21 alone; python renders the AppStream file.
+makedepends=('jdk21-openjdk' 'python')
+optdepends=('gnome-keyring: Secret Service provider for stored accounts'
+            'kwallet: Secret Service provider for stored accounts on Plasma'
+            'fuse2: mount an account as a virtual file system')
+options=('!strip' '!debug')
+# Upstream has no stable release yet; only the versioned tags are packaged.
+# pkgver drops the hyphen from the tag; see pkg.sh.
+_tag="v0.1.0-alpha.2"
+source=("${pkgname}-${pkgver}.tar.gz::https://github.com/Obiente/native/archive/refs/tags/${_tag}.tar.gz")
+sha256sums=('7df806cfb84c1bc3e3d1ce6c642003a16ed7d607546d89973fba31cd381fd699')
+
+_srcname="native-${_tag#v}"
+
+build() {
+  cd "$_srcname"
+
+  export JAVA_HOME=/usr/lib/jvm/java-21-openjdk
+  # keep Gradle's cache inside the build tree instead of ~/.gradle
+  export GRADLE_USER_HOME="$srcdir/gradle-home"
+
+  # Gradle resolves the dependency graph from Maven Central and Google's
+  # repository during this step, so build() needs network access.
+  ./gradlew --no-daemon --console=plain :ui:createDistributable
+}
+
+package() {
+  cd "$_srcname"
+
+  install -d "$pkgdir/opt/nextcloudnative"
+  cp -a ui/build/compose/binaries/main/app/NextcloudNative/. \
+    "$pkgdir/opt/nextcloudnative/"
+
+  # the launcher resolves its own directory through /proc/self/exe, so a
+  # symlink into /usr/bin keeps the application image self-contained
+  install -d "$pkgdir/usr/bin"
+  ln -s /opt/nextcloudnative/bin/NextcloudNative "$pkgdir/usr/bin/nextcloud-native"
+
+  # upstream's jpackage template, with the launcher path jpackage would fill in
+  sed "s|^Exec=.*|Exec=/opt/nextcloudnative/bin/NextcloudNative|" \
+    release/linux/jpackage/NextcloudNative.desktop \
+    > "$srcdir/nextcloudnative-NextcloudNative.desktop"
+  install -Dm644 "$srcdir/nextcloudnative-NextcloudNative.desktop" \
+    "$pkgdir/usr/share/applications/nextcloudnative-NextcloudNative.desktop"
+
+  install -Dm644 ui/src/desktopMain/resources/nextcloud-native.png \
+    "$pkgdir/usr/share/icons/hicolor/512x512/apps/dev.obiente.nextcloudnative.png"
+
+  # same renderer the packageDeb path uses, fed from gradle.properties so the
+  # metadata cannot drift away from the tag being built
+  python3 tools/render-linux-appstream-metadata.py \
+    release/linux/dev.obiente.nextcloudnative.metainfo.xml \
+    "$pkgdir/usr/share/metainfo/dev.obiente.nextcloudnative.metainfo.xml" \
+    "$(grep -Po '^ncDesktopPackageVersion=\K.*' gradle.properties)" \
+    "$(grep -Po '^ncVersionName=\K.*' gradle.properties)" \
+    "$(date -u -d "@$SOURCE_DATE_EPOCH" +%F)"
+
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}

nextcloud-native/pkg.sh

@@ -0,0 +1,56 @@
+# nextcloud-native - Nextcloud Native (https://github.com/Obiente/native),
+# an adaptive native Nextcloud client built with Kotlin/Compose Multiplatform.
+#
+# Source package: the PKGBUILD builds :ui:createDistributable from the release
+# tarball, which is the same jpackage application image upstream wraps into the
+# .deb that nextcloud-native-bin repackages.
+#
+# CONTRIBUTING.md lists an Android SDK, Rust and Node.js as prerequisites, but
+# those cover the mobile target, the Windows Explorer helper and the website.
+# The Linux desktop image builds with JDK 21 alone - verified against
+# v0.1.0-alpha.2 with ANDROID_HOME and ANDROID_SDK_ROOT unset.
+#
+# Release/version handling is identical to nextcloud-native-bin: every upstream
+# release is a prerelease and the list is dominated by per-build nightly-* and
+# rolling channel-* releases, so only the versioned v* tags are packaged, and
+# pkgver drops the hyphen (v0.1.0-alpha.2 -> 0.1.0alpha.2), which pacman sorts
+# older than a later plain 0.1.0, so no epoch is needed. See
+# nextcloud-native-bin/pkg.sh.
+
+UPSTREAM_REPO="Obiente/native"
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(jdk21-openjdk python)
+
+latest_tag() {
+  gh api "repos/$UPSTREAM_REPO/releases?per_page=100" \
+    --jq '[.[] | select(.tag_name | test("^v[0-9]"))] | .[0].tag_name'
+}
+
+tag_to_pkgver() {
+  sed 's/^v//; s/-//g'
+}
+
+latest_version() {
+  latest_tag | tag_to_pkgver
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local tag sha
+
+  tag="$(latest_tag)"
+  if [[ "$(tag_to_pkgver <<< "$tag")" != "$ver" ]]; then
+    echo "newest versioned release is $tag, not the requested $ver - try again" >&2
+    return 1
+  fi
+
+  sha="$(curl -sfL "https://github.com/$UPSTREAM_REPO/archive/refs/tags/$tag.tar.gz" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i \
+    -e "s|^_tag=.*|_tag=\"$tag\"|" \
+    -e "s|^sha256sums=.*|sha256sums=('$sha')|" \
+    "$pkgbuild"
+}

plezy-bin/.SRCINFO

@@ -0,0 +1,34 @@
+pkgbase = plezy-bin
+	pkgdesc = Modern client for Plex, Jellyfin and Emby (upstream binary)
+	pkgver = 2.22.0
+	pkgrel = 1
+	url = https://plezy.app
+	arch = x86_64
+	arch = aarch64
+	license = GPL-3.0-or-later
+	depends = alsa-lib
+	depends = glib2
+	depends = gtk3
+	depends = hicolor-icon-theme
+	depends = libdrm
+	depends = libepoxy
+	depends = libevdev
+	depends = libglvnd
+	depends = libva
+	depends = libx11
+	depends = libxcb
+	depends = libxext
+	depends = mesa
+	depends = wayland
+	provides = plezy=2.22.0
+	conflicts = plezy
+	noextract = plezy-bin-2.22.0-x86_64.deb
+	noextract = plezy-bin-2.22.0-aarch64.deb
+	options = !strip
+	options = !debug
+	source_x86_64 = plezy-bin-2.22.0-x86_64.deb::https://github.com/edde746/plezy/releases/download/2.22.0/plezy-linux-x64.deb
+	sha256sums_x86_64 = 295f40ee65d2d1fd937b32c86d6a9db2902733deac844b572d9ef209d6594390
+	source_aarch64 = plezy-bin-2.22.0-aarch64.deb::https://github.com/edde746/plezy/releases/download/2.22.0/plezy-linux-arm64.deb
+	sha256sums_aarch64 = dee4e2edfc0f5b1e2f9a6e52d4f4c660e086f3414769480e310aedc2ab489f7f
+
+pkgname = plezy-bin

plezy-bin/PKGBUILD

@@ -0,0 +1,54 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=plezy-bin
+pkgver=2.22.0
+pkgrel=1
+pkgdesc="Modern client for Plex, Jellyfin and Emby (upstream binary)"
+arch=('x86_64' 'aarch64')
+url="https://plezy.app"
+license=('GPL-3.0-or-later')
+# Upstream's own pacman dependency list, taken from the manifest that produces
+# the release packages (linux/packaging/build-packages.py) and kept in that
+# shape on purpose: the .deb repackaged here is the same bundle upstream's
+# .pkg.tar.zst carries. Almost everything the app links travels inside
+# /opt/plezy/lib - including GTK, glib, libmpv and ffmpeg - so what is declared
+# here is mostly what upstream deliberately does not bundle, because it is
+# coupled to the running compositor and GPU driver. libmpv in particular has to
+# be the bundled, Wayland-enabled build: a distro libmpv silently drops hwdec
+# to vaapi-copy on the native video plane.
+depends=('alsa-lib' 'glib2' 'gtk3' 'hicolor-icon-theme' 'libdrm' 'libepoxy'
+         'libevdev' 'libglvnd' 'libva' 'libx11' 'libxcb' 'libxext' 'mesa'
+         'wayland')
+provides=("plezy=${pkgver}")
+conflicts=('plezy')
+# prebuilt, and the runner finds its bundled libraries through the wrapper's
+# LD_LIBRARY_PATH rather than an RPATH
+options=('!strip' '!debug')
+# Release tags carry no v prefix (2.16.0), so the tag is pkgver as-is.
+source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::https://github.com/edde746/plezy/releases/download/${pkgver}/plezy-linux-x64.deb")
+source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::https://github.com/edde746/plezy/releases/download/${pkgver}/plezy-linux-arm64.deb")
+noextract=("${pkgname}-${pkgver}-x86_64.deb" "${pkgname}-${pkgver}-aarch64.deb")
+sha256sums_x86_64=('295f40ee65d2d1fd937b32c86d6a9db2902733deac844b572d9ef209d6594390')
+sha256sums_aarch64=('dee4e2edfc0f5b1e2f9a6e52d4f4c660e086f3414769480e310aedc2ab489f7f')
+
+package() {
+  # the Flutter bundle in /opt/plezy plus the /usr/bin wrapper, desktop entry
+  # and icons upstream's .deb installs
+  bsdtar -xOf "$srcdir/${pkgname}-${pkgver}-${CARCH}.deb" 'data.tar.*' \
+    | bsdtar -xpf - -C "$pkgdir" --exclude './usr/share/doc' ./opt ./usr
+
+  # upstream ships this one non-executable and fixes it up in the .deb's
+  # postinst, which pacman never runs
+  chmod 755 "$pkgdir/opt/plezy/lib/crashpad_handler"
+
+  # GPL-3.0-or-later is a common license (/usr/share/licenses/common/GPL3) and
+  # the .deb carries no license text of its own.
+
+  # Upstream builds its release binaries with ENABLE_UPDATE_CHECK=true, so
+  # unlike the [extra] package this one does check GitHub for new versions.
+  # On Linux that only ever opens a dialog with a browser link - there is no
+  # in-app install path to collide with pacman - and the dialog can be
+  # dismissed per version or turned off in the app's settings.
+}

plezy-bin/pkg.sh

@@ -0,0 +1,47 @@
+# plezy-bin - Plezy (https://github.com/edde746/plezy), a Plex, Jellyfin and
+# Emby client built with Flutter.
+#
+# Upstream builds the Linux release itself and publishes a .deb (plus .rpm,
+# .pkg.tar.zst and a portable tarball) per release, so there is no build step
+# here: on a new version only pkgver and the two checksums are refreshed and
+# the PKGBUILD repackages the .deb directly.
+#
+# plezy itself is in [extra], built from source by an Arch packager, so only
+# the -bin variant belongs in the AUR - a second source package would be a
+# duplicate the AUR rejects outright. The two conflict, and plezy-bin provides
+# plezy so either one satisfies a dependency on it. What it buys over the
+# repository package is release-day updates without the Flutter build, which
+# needs an fvm-pinned SDK and takes the better part of an hour.
+#
+# Release tags are plain versions with no v prefix (2.16.0), every release is a
+# full release, and the asset names are fixed (plezy-linux-x64.deb /
+# plezy-linux-arm64.deb), so /releases/latest is enough to track upstream.
+
+UPSTREAM_REPO="edde746/plezy"
+
+latest_version() {
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' | sed 's/^v//'
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local base sha_x64 sha_arm64
+
+  base="https://github.com/$UPSTREAM_REPO/releases/download/$ver"
+  sha_x64="$(curl -sfL "$base/plezy-linux-x64.deb" | sha256sum | cut -d' ' -f1)"
+  sha_arm64="$(curl -sfL "$base/plezy-linux-arm64.deb" | sha256sum | cut -d' ' -f1)"
+
+  # curl -f keeps a 404 page out of the sums; a missing asset ends up empty here
+  for sha in "$sha_x64" "$sha_arm64"; do
+    if [[ "$sha" == "$(printf '' | sha256sum | cut -d' ' -f1)" ]]; then
+      echo "one of the $ver .deb assets is missing or empty - try again" >&2
+      return 1
+    fi
+  done
+
+  sed -i \
+    -e "s|^sha256sums_x86_64=.*|sha256sums_x86_64=('$sha_x64')|" \
+    -e "s|^sha256sums_aarch64=.*|sha256sums_aarch64=('$sha_arm64')|" \
+    "$pkgbuild"
+}

schist-bin/.SRCINFO

@@ -0,0 +1,28 @@
+pkgbase = schist-bin
+	pkgdesc = Layered image editor with PSD and Affinity support (upstream binary)
+	pkgver = 0.15.0
+	pkgrel = 1
+	url = https://github.com/Infrawrench/schist
+	arch = x86_64
+	arch = aarch64
+	license = MIT
+	depends = fontconfig
+	depends = freetype2
+	depends = hicolor-icon-theme
+	depends = libxcb
+	depends = libxkbcommon
+	depends = libxkbcommon-x11
+	depends = vulkan-driver
+	depends = vulkan-icd-loader
+	depends = wayland
+	optdepends = libheif>=1.23.4: HEIC import
+	provides = schist=0.15.0
+	conflicts = schist
+	options = !strip
+	options = !debug
+	source_x86_64 = https://github.com/Infrawrench/schist/releases/download/v0.15.0/schist-0.15.0-1-x86_64.pkg.tar.zst
+	sha256sums_x86_64 = ef4501ecc8109e21d1813fdfc8d618090a9be5bb238545527614a1ff60d983c1
+	source_aarch64 = https://github.com/Infrawrench/schist/releases/download/v0.15.0/schist-0.15.0-1-aarch64.pkg.tar.zst
+	sha256sums_aarch64 = 11e12bd6bc0ee6fb6d27004809750c62a180d64c5eb274a2aac685fdabdeeff1
+
+pkgname = schist-bin

schist-bin/PKGBUILD

@@ -0,0 +1,37 @@
+# Maintainer: Felitendo
+# Contributor: Infrawrench LLC <astrid@infrawrench.com>
+# This PKGBUILD is updated automatically:
+# https://git.felo.gg/Felitendo/PKGBUILDS
+
+pkgname=schist-bin
+pkgver=0.15.0
+pkgrel=1
+# Upstream's own package release in the asset name, synced by pkg.sh. It only
+# moves when upstream repackages a version that has already shipped.
+_relver=1
+pkgdesc="Layered image editor with PSD and Affinity support (upstream binary)"
+arch=('x86_64' 'aarch64')
+url="https://github.com/Infrawrench/schist"
+license=('MIT')
+# The same list as the source package, checked by pkg.sh against upstream's
+# PKGBUILD. Upstream's own schist-bin makes vulkan-driver optional only to
+# keep its build container from pulling in nvidia-utils.
+depends=('fontconfig' 'freetype2' 'hicolor-icon-theme' 'libxcb' 'libxkbcommon'
+         'libxkbcommon-x11' 'vulkan-driver' 'vulkan-icd-loader' 'wayland')
+optdepends=('libheif>=1.23.4: HEIC import')
+provides=("schist=${pkgver}")
+conflicts=('schist')
+# upstream strips the debug info itself and keeps the build id for its crash
+# reports
+options=('!strip' '!debug')
+# The release asset is a pacman package built by upstream's CI
+# (packaging/linux/packages.sh). makepkg extracts it, only its usr/ is taken.
+source_x86_64=("${url}/releases/download/v${pkgver}/schist-${pkgver}-${_relver}-x86_64.pkg.tar.zst")
+source_aarch64=("${url}/releases/download/v${pkgver}/schist-${pkgver}-${_relver}-aarch64.pkg.tar.zst")
+sha256sums_x86_64=('ef4501ecc8109e21d1813fdfc8d618090a9be5bb238545527614a1ff60d983c1')
+sha256sums_aarch64=('11e12bd6bc0ee6fb6d27004809750c62a180d64c5eb274a2aac685fdabdeeff1')
+
+package() {
+  cp -a "$srcdir/usr" "$pkgdir/"
+  mv "$pkgdir/usr/share/licenses/schist" "$pkgdir/usr/share/licenses/$pkgname"
+}

schist-bin/pkg.sh

@@ -0,0 +1,61 @@
+# schist-bin - Schist (https://github.com/Infrawrench/schist), a layered image
+# editor in Rust (gpui) with PSD and Affinity support.
+#
+# Upstream builds the Linux release itself and publishes a .pkg.tar.zst per
+# architecture, which the PKGBUILD repackages, as upstream's own
+# packaging/linux/aur/schist-bin does. GitHub lists each asset's sha256, so a
+# new version needs no download.
+#
+# The asset name carries upstream's package release
+# (schist-<version>-<release>-<arch>.pkg.tar.zst), which is synced into
+# _relver. The binary needs the same libraries as the source package, so the
+# dependencies are checked against upstream's source PKGBUILD of the same tag:
+# a missing one would not break the test build, only the app.
+
+UPSTREAM_REPO="Infrawrench/schist"
+
+latest_version() {
+  gh api "repos/$UPSTREAM_REPO/releases/latest" --jq '.tag_name' | sed 's/^v//'
+}
+
+# pkgbuild_array <name>: the words of one array in a PKGBUILD on stdin, sorted
+pkgbuild_array() {
+  awk -v n="$1" '$0 ~ "^" n "=\\(" { f = 1 } f { sub(/#.*/, ""); print } f && /\)/ { exit }' \
+    | sed "s/^$1=(//; s/).*//" | tr -s " '\"" '\n' | sed '/^$/d' | sort
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local upstream assets relver arch sha sha_x86_64 sha_aarch64
+
+  upstream="$(gh api "repos/$UPSTREAM_REPO/contents/packaging/linux/aur/schist/PKGBUILD?ref=v$ver" \
+    -H 'Accept: application/vnd.github.raw')" || return 1
+  if [[ "$(pkgbuild_array depends <<< "$upstream")" != "$(pkgbuild_array depends < "$pkgbuild")" ]]; then
+    echo "upstream's depends changed in v$ver, update the PKGBUILD:" >&2
+    pkgbuild_array depends <<< "$upstream" >&2
+    return 1
+  fi
+
+  # "<name> sha256:<hex>" per pacman package of the release
+  assets="$(gh api "repos/$UPSTREAM_REPO/releases/tags/v$ver" \
+    --jq '.assets[] | select(.name | endswith(".pkg.tar.zst")) | "\(.name) \(.digest)"')"
+  relver="$(sed -n "s/^schist-$ver-\([0-9]*\)-x86_64\.pkg\.tar\.zst .*/\1/p" <<< "$assets" \
+    | sort -n | tail -n1)"
+
+  for arch in x86_64 aarch64; do
+    sha="$(awk -v f="schist-$ver-$relver-$arch.pkg.tar.zst" \
+      '$1 == f { sub(/^sha256:/, "", $2); print $2 }' <<< "$assets")"
+    if [[ ! "$sha" =~ ^[0-9a-f]{64}$ ]]; then
+      echo "v$ver has no schist-$ver-$relver-$arch.pkg.tar.zst with a sha256" >&2
+      return 1
+    fi
+    printf -v "sha_$arch" '%s' "$sha"
+  done
+
+  sed -i \
+    -e "s|^_relver=.*|_relver=$relver|" \
+    -e "s|^sha256sums_x86_64=.*|sha256sums_x86_64=('$sha_x86_64')|" \
+    -e "s|^sha256sums_aarch64=.*|sha256sums_aarch64=('$sha_aarch64')|" \
+    "$pkgbuild"
+}

schist/.SRCINFO

@@ -0,0 +1,26 @@
+pkgbase = schist
+	pkgdesc = Layered image editor with PSD and Affinity support
+	pkgver = 0.15.0
+	pkgrel = 1
+	url = https://github.com/Infrawrench/schist
+	arch = x86_64
+	arch = aarch64
+	license = MIT
+	makedepends = cargo
+	makedepends = clang
+	makedepends = mold
+	depends = fontconfig
+	depends = freetype2
+	depends = hicolor-icon-theme
+	depends = libxcb
+	depends = libxkbcommon
+	depends = libxkbcommon-x11
+	depends = vulkan-driver
+	depends = vulkan-icd-loader
+	depends = wayland
+	optdepends = libheif>=1.23.4: HEIC import
+	options = !lto
+	source = schist-0.15.0.tar.gz::https://github.com/Infrawrench/schist/archive/v0.15.0.tar.gz
+	sha256sums = ff11e4d29c47d6a8fe8736cb7efa6293894211b4f96cf9fca5bca9a0e7bb2585
+
+pkgname = schist