build(flatpak): make the manifest architecture-generic

Two things were x86-specific, both now expressed properly instead of
hardcoded:

  * PKG_CONFIG_PATH carries the runtime's multiarch directory.
    flatpak-builder does NOT shell-expand `env` values, so ${FLATPAK_ARCH}
    would be taken literally — a build-options.arch override supplies the
    aarch64 string and inherits the rest.

  * The prebuilt Skia archive is per-target and pinned by sha256. Two
    `type: file` sources discriminated by only-arches now share one
    dest-filename, so SKIA_BINARIES_URL stays a single literal path.
    Upstream publishes the aarch64 archive under the same skia commit hash
    and the same resolved-feature key, so the two stay in lockstep on a
    skia-safe bump.

build-flatpak.sh gains ARCH (default: this machine's), passes --arch to
both flatpak-builder and build-bundle, and arch-suffixes the bundle name so
an x86_64 and an aarch64 build can coexist in dist/ instead of the second
silently overwriting the first. CI composes its own published filename, so
nothing downstream changes.

The aarch64 Skia sha256 was verified by downloading the published archive,
not taken from the API. No aarch64 flatpak has been built — flatpak-builder
builds in a sandbox for the target arch, which needs an arm64 machine.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packaging/flatpak/README.md

@@ -125,6 +125,32 @@ curl -fsS --user "enricobuehler:$REGISTRY_TOKEN" \
 > home-worker-2 has no flatpak and no passwordless sudo to install it — so the Deck or the
 > privileged CI container are the only two viable build sites.
 
+### aarch64
+
+The manifest builds for aarch64 as well as x86_64. Two things are architecture-specific, and both
+are now expressed properly rather than hardcoded:
+
+* **`PKG_CONFIG_PATH`** contains the runtime's multiarch directory. flatpak-builder does *not*
+  shell-expand `env` values, so `${FLATPAK_ARCH}` would be taken literally — a `build-options.arch`
+  override supplies the aarch64 string instead, inheriting everything else.
+* **The prebuilt Skia archive** is per-target and pinned by sha256. There are now two `type: file`
+  sources discriminated by `only-arches`, both landing on the same `dest-filename`, so
+  `SKIA_BINARIES_URL` stays one literal path. Upstream publishes the aarch64 archive under the
+  same skia commit hash and the same resolved-feature key (`pdf-textlayout-vulkan`), so on a
+  skia-safe bump update both URLs and both hashes together.
+
+```sh
+ARCH=aarch64 bash packaging/flatpak/build-flatpak.sh
+# -> dist/punktfunk-client-<version>-aarch64.flatpak
+```
+
+`ARCH` defaults to this machine's, and the bundle name now carries the architecture so an x86_64
+and an aarch64 build can coexist in `dist/`. This is **not** a cross-compile: flatpak-builder runs
+the build in a sandbox for the target arch, so building aarch64 anywhere but an arm64 machine
+needs qemu binfmt and is very slow. Not yet verified end to end — the manifest is correct by
+construction and the Skia hash was checked against the published archive, but no aarch64 flatpak
+has been built.
+
 ## Manifest
 
 [`io.unom.Punktfunk.yml`](io.unom.Punktfunk.yml). Runtime `org.gnome.Platform//50`

packaging/flatpak/build-flatpak.sh

@@ -16,6 +16,12 @@
 #                      iteration, non-reproducible). Default: offline (regenerates cargo-sources).
 #   BUILDER=...        override the flatpak-builder invocation (default: auto-detect host
 #                      flatpak-builder, else `flatpak run org.flatpak.Builder`).
+#   ARCH=...           target architecture (default: this machine's). `aarch64` builds the arm64
+#                      client — the manifest carries the per-arch PKG_CONFIG_PATH and the matching
+#                      prebuilt Skia archive. NOTE this is not a cross-compile: flatpak-builder
+#                      runs the build inside a sandbox for that arch, so building aarch64 on an
+#                      x86_64 box needs qemu binfmt registered and is very slow. Run it on an
+#                      arm64 machine.
 set -euo pipefail
 
 ROOTDIR="$(cd "$(dirname "$0")/../.." && pwd)"
@@ -25,7 +31,11 @@ APP_ID="io.unom.Punktfunk"
 MANIFEST="packaging/flatpak/io.unom.Punktfunk.yml"
 VERSION="${VERSION:-$(git describe --tags --always --dirty 2>/dev/null || echo 0.0.1-dev)}"
 VERSION="${VERSION#v}"
-BUNDLE="dist/punktfunk-client-${VERSION}.flatpak"
+# `flatpak --default-arch` reports flatpak's own name for this machine (x86_64 / aarch64).
+ARCH="${ARCH:-$(flatpak --default-arch 2>/dev/null || uname -m)}"
+# Arch-suffixed so an x86_64 and an aarch64 bundle can sit in dist/ together instead of the
+# second silently overwriting the first. (CI composes its own published filename.)
+BUNDLE="dist/punktfunk-client-${VERSION}-${ARCH}.flatpak"
 
 # --- pick a flatpak-builder (host binary, or the org.flatpak.Builder flatpak on the Deck) ---
 if [ -n "${BUILDER:-}" ]; then
@@ -72,18 +82,19 @@ else
 fi
 
 # --- build into a local ostree repo, then export a single-file bundle --------------------
-echo "==> flatpak-builder ($APP_ID, version $VERSION)"
+echo "==> flatpak-builder ($APP_ID, version $VERSION, arch $ARCH)"
 # --default-branch=stable matches CI / the hosted repo ref, so a locally-built install can also
 # track flatpak.unom.io. build-bundle must then be told the branch (else it defaults to `master`).
 "${FPB[@]}" --user --force-clean --disable-rofiles-fuse \
   --default-branch=stable \
+  --arch="$ARCH" \
   --install-deps-from=flathub \
   "${EXTRA_ARGS[@]}" \
   --repo="$ROOTDIR/.flatpak-repo" \
   "$ROOTDIR/.flatpak-build" "$MANIFEST"
 
 mkdir -p dist
-flatpak build-bundle "$ROOTDIR/.flatpak-repo" "$BUNDLE" "$APP_ID" stable
+flatpak build-bundle --arch="$ARCH" "$ROOTDIR/.flatpak-repo" "$BUNDLE" "$APP_ID" stable
 echo "built $BUNDLE"
 ls -lh "$BUNDLE"
 echo

packaging/flatpak/io.unom.Punktfunk.yml

@@ -121,6 +121,14 @@ build-options:
     LIBCLANG_PATH: /usr/lib/sdk/llvm20/lib
     # mold (shipped in rust-stable) speeds the ~450-crate link on the Deck APU.
     RUSTFLAGS: -C link-arg=-fuse-ld=mold
+  # The multiarch directory in PKG_CONFIG_PATH is per-architecture, and flatpak-builder does NOT
+  # shell-expand `env` values — so ${FLATPAK_ARCH} would be taken literally. An `arch` override is
+  # the supported way to vary it; everything else above is inherited. Only the runtime's own
+  # /usr/lib/<triple> changes, so aarch64 differs from x86_64 in exactly this one string.
+  arch:
+    aarch64:
+      env:
+        PKG_CONFIG_PATH: /app/lib/pkgconfig:/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/lib/pkgconfig
 
 modules:
   # ---------------------------------------------------------------------------------------
@@ -240,7 +248,18 @@ modules:
       # crate's pinned skia commit + target + resolved features — when bumping skia-safe, build
       # the workspace once locally and take the new name from
       # target/release/build/skia-bindings-*/out/.cache/, then update url + sha256 together.
+      # One entry per architecture, selected by `only-arches`; both land on the SAME
+      # dest-filename, so SKIA_BINARIES_URL above stays a single literal path. The upstream
+      # release publishes the aarch64 archive under the same skia commit hash and the same
+      # resolved-feature key, so the two stay in lockstep on a skia-safe bump — take both new
+      # names and sha256s together.
       - type: file
+        only-arches: [x86_64]
         url: https://github.com/rust-skia/skia-binaries/releases/download/0.87.0/skia-binaries-e551f334ad5cbdf43abf-x86_64-unknown-linux-gnu-pdf-textlayout-vulkan.tar.gz
         sha256: b46e7061e6b9df792025acaf9b8b90180224c7cec63f4c3ce09af7ddddb8abfa
         dest-filename: skia-binaries.tar.gz
+      - type: file
+        only-arches: [aarch64]
+        url: https://github.com/rust-skia/skia-binaries/releases/download/0.87.0/skia-binaries-e551f334ad5cbdf43abf-aarch64-unknown-linux-gnu-pdf-textlayout-vulkan.tar.gz
+        sha256: 6994fb993064d7d4fff00bf7c79544ffc881bb5441b6768b31cc088540f4bef7
+        dest-filename: skia-binaries.tar.gz