shadow-testandClaude Sonnet 5
b3d07bda09
A review found the "Validate with makepkg and namcap" step's bind mount
(docker run -v "$PWD/rendered:/work") would very likely fail on Gitea's
own act_runner: a containerized job's $PWD isn't a path the daemon's host
can resolve, so the mount would silently attach an empty directory
instead of failing loudly — the same class of problem noted elsewhere for
this exact environment. Switched to docker create + docker cp (in and
back out) + docker start -a, the pattern already validated locally, which
works regardless of where the daemon actually lives.
Also found and fixed, most severe first:
- The namcap error gate (`grep -q "^[a-zA-Z0-9_-]*bin E:"`) only matched
one of namcap's two line shapes for reporting an error
("triple-c-bin E: ...") and missed the other ("PKGBUILD
(triple-c-bin) E: ...") entirely — confirmed by reproducing both against
a real namcap run. The PKGBUILD-level half of the safety net was dead.
Replaced with a plain `grep -q " E: "`, confirmed to match both real
shapes (and a split-package variant) and nothing else.
- package()'s `ar x "Triple-C_${pkgver}_amd64.deb"` named the asset
literally, defeating the whole point of the resolve step discovering
the real filename from the release instead of assuming a pattern — a
future Tauri bundler naming change would still break here with an
opaque error. Changed to `ar x ./*_amd64.deb`, which `source=()` already
guarantees matches exactly one file.
- `pacman -Sy` before installing packages is the canonical Arch partial-
upgrade footgun; changed to `pacman -Syu --noconfirm --needed`.
- `${{ inputs.version }}` was interpolated directly into a shell step
instead of routed through `env:`, unlike every other step in the file.
- `git push origin master` assumes the local branch name after cloning a
brand-new (not-yet-created) AUR repo's empty state is `master`, which
depends on the runner's own `init.defaultBranch` if the server sends no
symref. `git push origin HEAD:master` is unambiguous either way.
- The private key was written with a plain redirect then chmod'd after,
leaving a window where it's world-readable; now created at its final
mode first via `install -m 600 /dev/null`. Added `-o IdentitiesOnly=yes`
so a runner ssh-agent can't offer a different key first.
- Added GH_PAT auth to the api.github.com calls, matching every other
workflow in this repo, to avoid the unauthenticated 60/hour rate limit.
- Fixed two comments: the `options` comment credited `!debug` for
suppressing the empty debug-package directory, when it's actually
`!strip` doing that (verified in a real build); and documented in the
README that a hand-edit made directly in the AUR repo is silently
reverted by the next dispatch, since every run renders fresh from this
repo's template.
All of the above re-verified with the same real end-to-end methodology as
the original commit: real makepkg build, real namcap lint (clean), and
the exact updated docker create/cp/start sequence run against a live
container.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGjXq6fqtAFHdbhk4f3PfZ
87 lines
4.9 KiB
Bash
87 lines
4.9 KiB
Bash
# Maintainer: Triple-C Contributors
|
|
#
|
|
# This file is regenerated by .gitea/workflows/publish-aur-package.yml on every
|
|
# publish — pkgver, the source URL and sha256sums are rewritten from the real,
|
|
# already-uploaded release asset, never guessed. Editing pkgver/source/
|
|
# sha256sums by hand here only matters until the next automated run overwrites
|
|
# them; everything else (depends, pkgdesc, package()) is meant to be hand-
|
|
# maintained normally.
|
|
#
|
|
# "-bin" rather than building from source: this repackages the same .deb
|
|
# build-app.yml already produces and publishes, so a user gets exactly the
|
|
# binary the project ships and tests, and `makepkg` never needs a Rust
|
|
# toolchain, Node, or the dozen -dev packages CLAUDE.md lists for building
|
|
# Triple-C itself. The trade-off is the one every "-bin" package makes: it
|
|
# assumes the glibc the CI runner (Ubuntu 24.04) linked against is compatible
|
|
# with the installing system's — true for essentially every currently
|
|
# supported Arch install, since Arch tracks glibc newer than Ubuntu 24.04
|
|
# ships, and forward compatibility is the direction that holds.
|
|
pkgname=triple-c-bin
|
|
pkgver=0.4.0
|
|
pkgrel=1
|
|
pkgdesc="Sandbox Claude Code inside Docker containers"
|
|
arch=('x86_64')
|
|
url="https://github.com/shadowdao/triple-c"
|
|
license=('MIT')
|
|
# Verified against a real release asset (v0.4.14), not Tauri's generic docs:
|
|
# downloaded Triple-C_0.4.14_amd64.deb, installed each of these into a real
|
|
# Arch container, and re-ran `ldd` on the actual binary until nothing came
|
|
# back "not found". `pango` and `libayatana-appindicator` were both in an
|
|
# earlier draft — pango isn't directly linked (gtk3 already pulls it in
|
|
# transitively, and namcap correctly flags declaring it as redundant), and
|
|
# libayatana-appindicator is in Tauri's own linux dependency list but this
|
|
# binary never links it at all: there is no tray icon or menu in this app
|
|
# (see CLAUDE.md's note that `core:menu`/`core:tray` are dropped for the
|
|
# same reason), so it was never a real dependency to begin with.
|
|
depends=('cairo' 'desktop-file-utils' 'gdk-pixbuf2' 'glib2' 'gtk3'
|
|
'hicolor-icon-theme' 'libsoup3' 'webkit2gtk-4.1')
|
|
optdepends=('docker: to actually run the sandboxed containers'
|
|
'xdg-utils: opening links from the app in your default browser')
|
|
provides=('triple-c')
|
|
conflicts=('triple-c')
|
|
# !strip: the upstream .deb's binary is already the release build Tauri
|
|
# produced and tested; re-stripping a prebuilt binary is unnecessary risk for
|
|
# no benefit. It's also what actually suppresses makepkg's debug-package
|
|
# machinery here (debug-package extraction requires strip; verified in a
|
|
# real build — with !strip alone, no debug package is produced at all).
|
|
# !debug is kept anyway, explicit about intent rather than relying on that
|
|
# side effect. Without either, makepkg built a usr/src/debug/triple-c-bin
|
|
# tree containing a dangling .build-id symlink, which is a real namcap
|
|
# error (not just the empty-directory warning it looks like) — there is no
|
|
# debug info in this release binary for the machinery to have extracted in
|
|
# the first place.
|
|
options=('!strip' '!debug')
|
|
# Tauri names the asset after `productName` verbatim ("Triple-C"), not the
|
|
# lowercase Cargo binary name — verified against the real release, not
|
|
# assumed; a lowercase guess here would 404. The LICENSE fetch is separate
|
|
# because the .deb itself carries no license file — namcap flags an MIT
|
|
# package with nothing under /usr/share/licenses/ as an error, correctly.
|
|
source=("Triple-C_${pkgver}_amd64.deb::https://github.com/shadowdao/triple-c/releases/download/v${pkgver}/Triple-C_${pkgver}_amd64.deb"
|
|
"LICENSE::https://raw.githubusercontent.com/shadowdao/triple-c/v${pkgver}/LICENSE")
|
|
sha256sums=('SKIP'
|
|
'SKIP')
|
|
|
|
package() {
|
|
cd "$srcdir"
|
|
# A .deb is an ar archive of debian-binary, control.tar.*, data.tar.* — `ar`
|
|
# (part of base-devel's binutils) pulls just the payload out. Extracting
|
|
# that tar directly into $pkgdir works here with no path rewriting at all:
|
|
# verified against the real archive, whose entire payload is
|
|
# usr/bin/triple-c, usr/share/applications/Triple-C.desktop and
|
|
# usr/share/icons/hicolor/*/apps/triple-c.png — Tauri's Linux bundle for
|
|
# this app carries no separate resource directory under usr/lib/, so there
|
|
# is nothing that could disagree between Debian's and Arch's package trees
|
|
# for it to land in the wrong place.
|
|
#
|
|
# Globbed rather than named literally: the publish workflow discovers the
|
|
# real asset name from the release itself specifically so a Tauri bundler
|
|
# naming change can't silently break this — naming the file again here
|
|
# would throw that away and fail this one line with an opaque "No such
|
|
# file or directory" instead. `source=()` above guarantees exactly one
|
|
# `*_amd64.deb` entry, so the glob can only ever match that one file.
|
|
ar x ./*_amd64.deb
|
|
tar xf data.tar.* -C "$pkgdir"
|
|
|
|
install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
|
|
}
|