feat(packaging/arch): distribute binary packages via the Gitea Arch registry

New arch.yml builds the split PKGBUILD (host/client/web, PF_WITH_WEB=1) in an
archlinux:base-devel container on every push and publishes to the pacman repos
'punktfunk' (tags) / 'punktfunk-canary' (main, X.Y.Z-0.<run#> — pkgrel allows
only digits+dots, so the run number carries the ordering). Consumers add one
pacman.conf section; no more build-it-yourself as the only Arch path.

PKGBUILD: pkgver/pkgrel env-driven (PF_PKGVER/PF_PKGREL), source=() when
PF_SRCDIR is set (a canary version has no tag to clone), stale NVENC-only
header fixed, and options=('!lto' '!debug') — makepkg's lto option injects
-flto=auto into CFLAGS, aws-lc-sys compiles its C with it, and rust's lld
cannot read GCC LTO bitcode: 'undefined symbol: aws_lc_*' at link (reproduced
minimally on Arch + rust 1.90). Full build + clean-container install
smoke-tested locally (binaries run, payload + scriptlets intact).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packaging/arch/PKGBUILD

@@ -10,20 +10,28 @@
 #   - In-tree / CI:       PF_SRCDIR=$(git rev-parse --show-toplevel) makepkg --holdver
 #                         (builds the working tree instead of the tagged source — see build()).
 #
-# IMPORTANT: host encode is NVENC-only (crates/punktfunk-host/src/encode/linux.rs) — functional on
-# NVIDIA hosts; an AMD Deck-as-HOST needs a VAAPI backend first. The CLIENT decodes via VAAPI
-# (AMD/Intel, incl. the Deck) with a software fallback, so it works everywhere. See README.md.
+# Host encode: NVENC on NVIDIA (nvidia-utils), VAAPI on AMD/Intel (mesa) — PUNKTFUNK_ENCODER=auto
+# picks per GPU. The CLIENT decodes via VAAPI (AMD/Intel, incl. the Deck) with a software
+# fallback, so it works everywhere. See README.md.
 pkgbase=punktfunk
 # punktfunk-web (the browser console) is OPT-IN: building it needs `bun` (AUR-only as bun-bin on
 # stock Arch/SteamOS), so a default makepkg builds only host+client with no JS tooling — mirroring
 # the RPM spec's `%bcond_with web` (off by default). Set PF_WITH_WEB=1 to also build punktfunk-web
 # (appended to pkgname + bun to makedepends below).
 pkgname=('punktfunk-host' 'punktfunk-client')
-pkgver=0.2.0
-pkgrel=1
+# CI (.gitea/workflows/arch.yml) drives the version: stable tags -> X.Y.Z-1, main pushes ->
+# X.Y.Z-0.<run#> in the separate punktfunk-canary repo (mirrors the RPM's 0.ciN release; pkgrel
+# allows only digits+dots, so the run number carries the monotonic ordering).
+pkgver="${PF_PKGVER:-0.7.0}"
+pkgrel="${PF_PKGREL:-1}"
 arch=('x86_64')
 url="https://git.unom.io/unom/punktfunk"
 license=('MIT OR Apache-2.0')
+# !lto: makepkg's `lto` option injects -flto=auto into CFLAGS; aws-lc-sys (rustls' crypto)
+# compiles its C with those flags and GCC LTO bitcode objects are unreadable by rust's lld
+# linker -> "undefined symbol: aws_lc_*" at link (reproduced 2026-07-04, Arch + rust 1.90).
+# !debug: skip the -debug split package (debuginfo bloat, not shipped).
+options=('!lto' '!debug')
 
 # All build deps for both crates (Arch runtime packages ship their own headers, so these cover
 # build + link). aws-lc/ring need clang+cmake; nasm is for asm.
@@ -36,10 +44,16 @@ if [ "${PF_WITH_WEB:-0}" = 1 ]; then
   makedepends+=('bun')   # `bun-bin` from the AUR if bun isn't in your configured repos
 fi
 
-# AUR source (a tagged release). For an in-tree CI build, set PF_SRCDIR to the repo root and
-# build() uses it instead; see the README.
-source=("git+https://git.unom.io/unom/punktfunk.git#tag=v${pkgver}")
-sha256sums=('SKIP')
+# AUR source (a tagged release). For an in-tree CI build, set PF_SRCDIR to the repo root —
+# build() uses it instead AND the fetch is skipped entirely (a canary pkgver has no tag to
+# clone, and CI already has the checkout).
+if [ -z "${PF_SRCDIR:-}" ]; then
+  source=("git+https://git.unom.io/unom/punktfunk.git#tag=v${pkgver}")
+  sha256sums=('SKIP')
+else
+  source=()
+  sha256sums=()
+fi
 
 _repo() { printf '%s' "${PF_SRCDIR:-$srcdir/punktfunk}"; }
 

packaging/arch/README.md

@@ -23,7 +23,36 @@ default `makepkg` builds only host+client with no JS tooling — mirroring the R
 > Arch + NVIDIA **and** AMD/Intel (incl. the Steam Deck — see the on-device path above). The client
 > decodes via VAAPI on AMD/Intel with a software fallback.
 
-## Arch Linux (mutable)
+## Install from the binary repo (recommended)
+
+CI (`.gitea/workflows/arch.yml`) builds this PKGBUILD in an `archlinux:base-devel` container on
+every push and publishes the packages to the **Gitea Arch package registry** — a plain pacman
+repo, so an Arch box installs and updates punktfunk with `pacman -Syu` like everything else.
+Two repos mirror the deb/rpm channels: `punktfunk` (release tags) and `punktfunk-canary`
+(rolling main-branch builds, versioned `X.Y.Z-0.<run#>` so a later release always outranks
+them). Enable exactly one:
+
+```sh
+sudo tee -a /etc/pacman.conf >/dev/null <<'EOF'
+
+[punktfunk]
+SigLevel = Optional TrustAll
+Server = https://git.unom.io/api/packages/unom/arch/$repo/$arch
+EOF
+
+sudo pacman -Sy punktfunk-host        # gaming rig
+sudo pacman -Sy punktfunk-client      # couch/Deck side
+sudo pacman -Sy punktfunk-web         # optional browser management console
+```
+
+(`SigLevel = Optional TrustAll`: the packages are unsigned; transport security comes from HTTPS
+to the registry. Arch is rolling — the packages are built against current Arch sonames, so keep
+the box itself updated too.)
+
+Then the same first-run steps as a source build (printed by the install scriptlet): `input`
+group, `host.env`, `systemctl --user enable --now punktfunk-host` — see the next section.
+
+## Build from source — Arch Linux (mutable)
 
 ```sh
 cd packaging/arch