Package AURoscope v1 for self-hosted Arch installation #28

Closed

hephaistos wants to merge 3 commits from work/issue-26-package-aur-installable-pour-la-v1 into main

hephaistos commented

2026-08-31 12:52:39 +00:00

Owner

Closes #26.

What changed

add a self-hosted packaging/arch/PKGBUILD and generated .SRCINFO for auroscope 0.1.0;
pin the already-merged v1 source commit c5b5e1bd2b0b893b2b2147a311eb0d29bbc2ce00 and its SHA-256 digest;
carry the Codex 0.151.0 compatibility fix as the checksum-pinned local source codex-0.151.0.patch, making the package independent of PR #27 and review-branch commit retention;
declare the supported runtime contract explicitly: glibc, Git, post-fix paru-git, and openai-codex-bin 0.150.1/0.151.0;
build the CGO Go binary as a trimmed PIE and run the Go suite from check();
document dependency bootstrap, Codex authentication, build/install, state paths, checks, and removal;
add a guarded disposable-Arch package E2E that verifies .SRCINFO, clean build, namcap, install, official passthrough without Codex, real Paru AUR guard success/drift rejection, and uninstall.

The package remains self-hosted. Nothing is published to aur.archlinux.org.

Verification

CGO_ENABLED=1 go test ./... — pass
go vet ./... — pass
backport patch dry-run/application and equality with the reviewed source files — pass
source and patch SHA-256 checks — pass
shell syntax and git diff --check — pass
AUROSCOPE_E2E_DISPOSABLE_ARCH=1 scripts/e2e-disposable-arch.sh — pass
AUROSCOPE_E2E_SUPPORTED_PARU=1 scripts/e2e-supported-paru.sh — pass
AUROSCOPE_E2E_ARCH_PACKAGE=1 scripts/e2e-arch-package.sh — pass after the durable-source correction; generated .SRCINFO matched, sources/checksums/prepare() passed, package auroscope 0.1.0-1 built and installed, official passthrough and guard drift rejection ran, then the package was uninstalled

All Pacman, makepkg, and installation activity ran inside the digest-pinned disposable Arch container; the workstation package state was untouched.

Risks and limits

tagged Paru 2.1.0 lacks the required interactive-output fix, so the package deliberately requires paru-git>=2.1.0.r67.g9ac3578;
AURoscope currently accepts only Codex CLI 0.150.1 and 0.151.0, so the package constrains openai-codex-bin below 0.152.0;
those AUR dependencies must be reviewed and bootstrapped before AURoscope can install them;
the temporary checked-in backport should be removed when a future package version pins a merged source commit that already contains the Codex compatibility change;
namcap cannot infer executables launched dynamically and reports expected false-positive unused-dependency warnings for Git, Paru, and Codex; it reports no packaging errors.

Review guidance

Review packaging/arch/PKGBUILD against .SRCINFO, confirm that the pinned base commit is on main and codex-0.151.0.patch reproduces commit 1e99e8214214263fb7697dda76f5940c2844f89d, then inspect scripts/e2e-arch-package.sh for host-safety guards and proof that the installed binary—not a workspace build—runs the official and AUR guard paths.

Closes #26. ## What changed - add a self-hosted `packaging/arch/PKGBUILD` and generated `.SRCINFO` for `auroscope` 0.1.0; - pin the already-merged v1 source commit `c5b5e1bd2b0b893b2b2147a311eb0d29bbc2ce00` and its SHA-256 digest; - carry the Codex 0.151.0 compatibility fix as the checksum-pinned local source `codex-0.151.0.patch`, making the package independent of PR #27 and review-branch commit retention; - declare the supported runtime contract explicitly: glibc, Git, post-fix `paru-git`, and `openai-codex-bin` 0.150.1/0.151.0; - build the CGO Go binary as a trimmed PIE and run the Go suite from `check()`; - document dependency bootstrap, Codex authentication, build/install, state paths, checks, and removal; - add a guarded disposable-Arch package E2E that verifies `.SRCINFO`, clean build, namcap, install, official passthrough without Codex, real Paru AUR guard success/drift rejection, and uninstall. The package remains self-hosted. Nothing is published to aur.archlinux.org. ## Verification - `CGO_ENABLED=1 go test ./...` — pass - `go vet ./...` — pass - backport patch dry-run/application and equality with the reviewed source files — pass - source and patch SHA-256 checks — pass - shell syntax and `git diff --check` — pass - `AUROSCOPE_E2E_DISPOSABLE_ARCH=1 scripts/e2e-disposable-arch.sh` — pass - `AUROSCOPE_E2E_SUPPORTED_PARU=1 scripts/e2e-supported-paru.sh` — pass - `AUROSCOPE_E2E_ARCH_PACKAGE=1 scripts/e2e-arch-package.sh` — pass after the durable-source correction; generated `.SRCINFO` matched, sources/checksums/`prepare()` passed, package `auroscope 0.1.0-1` built and installed, official passthrough and guard drift rejection ran, then the package was uninstalled All Pacman, makepkg, and installation activity ran inside the digest-pinned disposable Arch container; the workstation package state was untouched. ## Risks and limits - tagged Paru 2.1.0 lacks the required interactive-output fix, so the package deliberately requires `paru-git>=2.1.0.r67.g9ac3578`; - AURoscope currently accepts only Codex CLI 0.150.1 and 0.151.0, so the package constrains `openai-codex-bin` below 0.152.0; - those AUR dependencies must be reviewed and bootstrapped before AURoscope can install them; - the temporary checked-in backport should be removed when a future package version pins a merged source commit that already contains the Codex compatibility change; - namcap cannot infer executables launched dynamically and reports expected false-positive unused-dependency warnings for Git, Paru, and Codex; it reports no packaging errors. ## Review guidance Review `packaging/arch/PKGBUILD` against `.SRCINFO`, confirm that the pinned base commit is on `main` and `codex-0.151.0.patch` reproduces commit `1e99e8214214263fb7697dda76f5940c2844f89d`, then inspect `scripts/e2e-arch-package.sh` for host-safety guards and proof that the installed binary—not a workspace build—runs the official and AUR guard paths.

Rows
Columns

Package AURoscope v1 for self-hosted Arch installation #28

What changed

Verification

Risks and limits

Review guidance

Pull request closed