mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-11 13:27:44 +01:00
Krzysztof kuhy Rudnicki
cc19d568a3
AUR registration is currently returning a bare nginx 503 server-side, so the three packages (todo-flutter, habit-stack, diet-guard-app) are built and verified but cannot be published yet. This runs the whole thing unattended whenever signup reopens. anubis_gate.py exists because the AUR sits behind Anubis: every HTML request gets a proof-of-work challenge page carrying HTTP *200*, so a plain curl reports 200 for a page that is actually unreachable. That is how the 503 got misdiagnosed twice as a local/browser/IPv6 problem. The module solves the challenge and reports the status of the real page behind it. Fail-closed by construction: each package is built, namcap'd, installed and LAUNCHED before it is pushed, and check_aur_rules() blocks the push on the mechanically checkable submission rules (maintainer line, x86_64, no replaces=, not already in an official repo, .SRCINFO matching the PKGBUILD). Verified by injecting a replaces= violation: the push was blocked and reported. A failing package is skipped; the others still publish. Signup itself stays manual — it needs an email confirmation, and creating accounts is not something this should do on the user's behalf. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Aoa1nKWRrAbowz7Hfd3tgL
46 lines
1.9 KiB
Markdown
46 lines
1.9 KiB
Markdown
# aur-publish
|
|
|
|
Hands-off publishing of kuhy's Flutter apps to the AUR.
|
|
|
|
```bash
|
|
~/utils/aur-publish/publish.sh # wait for registration, then publish
|
|
~/utils/aur-publish/publish.sh --dry-run # everything except the push
|
|
~/utils/aur-publish/publish.sh --skip-wait # account already works
|
|
~/utils/aur-publish/publish.sh --only habit-stack
|
|
```
|
|
|
|
## What it does
|
|
|
|
1. Polls `/register` until AUR signup reopens, opens it in a browser and
|
|
prints the SSH key to paste. **Signup is the only manual step** — it
|
|
requires email confirmation.
|
|
2. Waits for `ssh aur@aur.archlinux.org` to authenticate.
|
|
3. Then, unattended, per package: resolve the newest `vX.Y.Z` tag → set
|
|
`pkgver` → `updpkgsums` → `makepkg -C` → `namcap` → AUR rule check →
|
|
`pacman -U` → launch check → `.SRCINFO` → commit → push.
|
|
|
|
Every package is built, installed and **launched** before it is pushed, so a
|
|
broken package cannot reach the AUR. A package failing any gate is skipped and
|
|
reported; the others still publish. Safe to re-run.
|
|
|
|
## anubis_gate.py
|
|
|
|
The AUR sits behind [Anubis](https://anubis.techaro.lol/), which answers HTML
|
|
requests with a proof-of-work challenge page carrying **HTTP 200**. A plain
|
|
`curl` therefore reports 200 for a page that is actually unreachable — which is
|
|
exactly how "is registration back?" gets answered wrong. This module solves the
|
|
challenge and reports the status of the *real* page behind it.
|
|
|
|
```bash
|
|
python3 anubis_gate.py /register # prints the true status code
|
|
```
|
|
|
|
## AUR rules enforced before pushing
|
|
|
|
The AUR does not review uploads, but per the submission guidelines "packages
|
|
that violate the rules may be deleted without warning". `check_aur_rules()`
|
|
blocks a push on the mechanically checkable ones: `# Maintainer:` line,
|
|
`x86_64` in `arch`, no `replaces=` (reserved for renames — use `conflicts`),
|
|
not already in an official repo, `pkgdesc`/`url`/`license` present, and
|
|
`.SRCINFO` matching the PKGBUILD.
|