feat: desktop dual-stack PAM routing, virtual fprintd D-Bus bridge, and disconnect cancellation

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: CI - Rust
+name: CI - Rust & Packages
 
 on:
   push:
@@ -8,8 +8,13 @@ on:
       - 'tapauthd/**'
       - 'client-pam/**'
       - 'client-config-gui/**'
+      - 'server-android/**'
       - 'proto/**'
-      - 'scripts/ci/check-production-build.sh'
+      - 'packaging/**'
+      - 'systemd/**'
+      - 'scripts/**'
+      - 'install.sh'
+      - 'uninstall.sh'
       - 'Cargo.toml'
       - 'Cargo.lock'
       - '.github/workflows/ci.yml'
@@ -20,8 +25,13 @@ on:
       - 'tapauthd/**'
       - 'client-pam/**'
       - 'client-config-gui/**'
+      - 'server-android/**'
       - 'proto/**'
-      - 'scripts/ci/check-production-build.sh'
+      - 'packaging/**'
+      - 'systemd/**'
+      - 'scripts/**'
+      - 'install.sh'
+      - 'uninstall.sh'
       - 'Cargo.toml'
       - 'Cargo.lock'
       - '.github/workflows/ci.yml'
@@ -31,8 +41,8 @@ env:
   RUST_BACKTRACE: 1
 
 jobs:
-  build-and-test:
-    name: Build and Test All Modules
+  lint-and-format:
+    name: Code Quality & Format Checks
     runs-on: ubuntu-latest
 
     steps:
@@ -47,6 +57,51 @@ jobs:
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
 
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libdbus-1-dev \
+            pkg-config \
+            libpam0g-dev \
+            protobuf-compiler \
+            libgtk-4-dev \
+            build-essential
+
+      - name: Check Rust formatting
+        run: cargo fmt --all -- --check
+
+      - name: Run clippy (default features)
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+      - name: "Run clippy (dev sandbox, fallback-socket)"
+        run: cargo clippy -p tapauthd --features fallback-socket --all-targets -- -D warnings
+
+      - name: "Run clippy (E2E build, UDP loopback + PolKit bypass)"
+        run: cargo clippy -p tapauthd --no-default-features --features ble,dev-udp-loopback,dev-polkit-bypass --all-targets -- -D warnings
+
+      - name: "Run clippy (state-dir override only)"
+        run: cargo clippy -p tapauthd --no-default-features --features dev-state-override --all-targets -- -D warnings
+
+      - name: Verify production binaries contain no dev/test overrides
+        run: ./scripts/ci/check-production-build.sh
+
+
+  build-and-test:
+    name: Build and Test Workspace Modules
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+
       - name: Install system dependencies
         run: |
           sudo apt-get update
@@ -82,9 +137,6 @@ jobs:
       - name: Build all workspace members
         run: cargo build --workspace --verbose
 
-      - name: Verify production binaries contain no dev/test overrides
-        run: ./scripts/ci/check-production-build.sh
-
       - name: Run tests for shared library
         run: cargo test --manifest-path shared/Cargo.toml --verbose
 
@@ -99,18 +151,3 @@ jobs:
 
       - name: Run all workspace tests
         run: cargo test --workspace --verbose
-
-      - name: Check formatting
-        run: cargo fmt --all -- --check
-
-      - name: Run clippy (default features)
-        run: cargo clippy --workspace --all-targets -- -D warnings
-
-      - name: "Run clippy (dev sandbox, fallback-socket)"
-        run: cargo clippy -p tapauthd --features fallback-socket --all-targets -- -D warnings
-
-      - name: "Run clippy (E2E build, UDP loopback + PolKit bypass)"
-        run: cargo clippy -p tapauthd --no-default-features --features ble,dev-udp-loopback,dev-polkit-bypass --all-targets -- -D warnings
-
-      - name: "Run clippy (state-dir override only)"
-        run: cargo clippy -p tapauthd --no-default-features --features dev-state-override --all-targets -- -D warnings

.github/workflows/release-arch-git.yml

@@ -0,0 +1,70 @@
+name: "Release: Arch AUR (Git)"
+
+"on":
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: aur-git-push
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  release-arch-aur-git:
+    name: Arch User Repository (AUR) Git Sync
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - name: Checkout Source Context
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Synchronize and Push Metadata Changes to AUR (tapauth-git)
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.AUR_SSH_PRIVATE_KEY }}" > ~/.ssh/id_aur
+          chmod 600 ~/.ssh/id_aur
+          ssh-keyscan -t ed25519 aur.archlinux.org >> ~/.ssh/known_hosts
+
+          eval $(ssh-agent -s)
+          ssh-add ~/.ssh/id_aur
+
+          git config --global user.name "AUR Deployment Pipeline"
+          git config --global user.email "lolle2000.la+tapauth@gmail.com"
+
+          git clone aur@aur.archlinux.org:tapauth-git.git aur-repo
+
+          # Synchronize from repository packaging/arch-git/
+          cp packaging/arch-git/PKGBUILD aur-repo/PKGBUILD
+          cp packaging/arch-git/tapauth-git.install aur-repo/tapauth-git.install
+          cp packaging/arch-git/tapauth-fprintd-git.install aur-repo/tapauth-fprintd-git.install
+
+          # Dynamically compute git pkgver matching PKGBUILD pkgver()
+          GIT_DESC=$(git describe --long --tags 2>/dev/null || echo "")
+          if [ -n "$GIT_DESC" ]; then
+            NEW_PKGVER=$(echo "$GIT_DESC" | sed -E 's/^v//;s/-([0-9]+)-g([0-9a-f]+)$/.r\1.g\2/;s/-/_/g')
+          else
+            BASE_TAG=$(git tag --sort=-version:refname 2>/dev/null | grep -E '^v[0-9]' | head -1 | sed 's/^v//' || echo "0.1.0")
+            NEW_PKGVER="${BASE_TAG:-0.1.0}.r$(git rev-list --count HEAD).g$(git rev-parse --short HEAD)"
+          fi
+          sed -i "s/^pkgver=.*/pkgver=${NEW_PKGVER}/" aur-repo/PKGBUILD
+
+          # Regenerate .SRCINFO via makepkg (must run as non-root)
+          docker run --rm -v "$(pwd)/aur-repo:/pkg" archlinux:base-devel \
+            bash -c "useradd -m builder && chown -R builder:builder /pkg && su builder -c 'cd /pkg && makepkg --printsrcinfo > .SRCINFO'"
+
+          cd aur-repo
+
+          git add -A
+
+          if git diff --cached --quiet; then
+            echo "No changes in tapauth-git packaging files. Skipping commit."
+            exit 0
+          fi
+
+          git commit -m "Automated sync from main (${GITHUB_SHA::8})"
+          git push origin master

.github/workflows/release-arch.yml

@@ -5,6 +5,10 @@ name: "Release: Arch AUR"
     types: [published]
   workflow_dispatch:
 
+concurrency:
+  group: aur-push
+  cancel-in-progress: false
+
 permissions:
   contents: write
 
@@ -22,7 +26,7 @@ jobs:
         id: version_vars
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            RELEASE_JSON=$(gh api "repos/${{ github.repository }}/releases?per_page=1" --jq '.[0] | {tag_name, prerelease}')
+            RELEASE_JSON=$(gh api "repos/${{ github.repository }}/releases?per_page=10" --jq '[.[] | select(.prerelease == false)] | .[0] | {tag_name, prerelease}')
             TAG_NAME=$(echo "$RELEASE_JSON" | jq -r '.tag_name')
           else
             TAG_NAME="${GITHUB_REF_NAME}"
@@ -37,7 +41,7 @@ jobs:
         id: calc_sha
         run: |
           TARBALL_URL="https://github.com/lolle2000la/tapauth/archive/refs/tags/v${{ steps.version_vars.outputs.VERSION }}.tar.gz"
-          curl -sL "$TARBALL_URL" -o release.tar.gz
+          curl -sLf "$TARBALL_URL" -o release.tar.gz
           SHA256_HASH=$(sha256sum release.tar.gz | cut -d' ' -f1)
           echo "SHA256=${SHA256_HASH}" >> "$GITHUB_OUTPUT"
           echo "Release archive verified hash: ${SHA256_HASH}"
@@ -56,99 +60,29 @@ jobs:
           git config --global user.email "lolle2000.la+tapauth@gmail.com"
 
           git clone aur@aur.archlinux.org:tapauth.git aur-repo
-          cd aur-repo
-
-          # Added aarch64 to arch layout matrix, removed self-conflicting references
-          cat > PKGBUILD <<EOF
-          pkgname=tapauth
-          pkgver=${{ steps.version_vars.outputs.VERSION }}
-          pkgrel=1
-          pkgdesc="Local smartphone-based authentication framework engine"
-          arch=('x86_64' 'aarch64')
-          url="https://github.com/lolle2000la/tapauth"
-          license=('AGPL-3.0')
-          depends=('dbus' 'pam')
-          makedepends=('cargo' 'rust' 'protobuf' 'clang')
-          backup=('etc/tapauth/config.toml')
-          install=tapauth.install
-          source=("\$pkgname-\$pkgver.tar.gz::https://github.com/lolle2000la/tapauth/archive/refs/tags/v\$pkgver.tar.gz")
-          sha256sums=('${{ steps.calc_sha.outputs.SHA256 }}')
-
-          prepare() {
-            cd "\$srcdir/\$pkgname-\$pkgver"
-            export CARGO_HOME="\${srcdir}/cargo-home"
-            cargo fetch --locked --target "\$CARCH-unknown-linux-gnu"
-          }
-
-          build() {
-            cd "\$srcdir/\$pkgname-\$pkgver"
-            export CARGO_HOME="\${srcdir}/cargo-home"
-            export CARGO_PROFILE_RELEASE_STRIP=true
-            cargo build --frozen --workspace --release
-          }
+
+          # Copy source packaging files
+          cp packaging/arch/tapauth.install aur-repo/tapauth.install
+          cp packaging/arch/tapauth-fprintd.install aur-repo/tapauth-fprintd.install
+          cp packaging/arch/PKGBUILD aur-repo/PKGBUILD
+          cp config.toml.example aur-repo/config.toml.example
 
-          package() {
-            cd "\$srcdir/\$pkgname-\$pkgver"
-            install -dm0755 "\$pkgdir/etc/tapauth"
-            install -Dm0755 target/release/tapauthd "\$pkgdir/usr/bin/tapauthd"
-            install -Dm0755 target/release/tapauth-config "\$pkgdir/usr/bin/tapauth-config"
-            install -Dm0755 target/release/libclient_pam.so "\$pkgdir/usr/lib/security/pam_tapauth.so"
-            install -Dm0644 systemd/tapauthd.service "\$pkgdir/usr/lib/systemd/system/tapauthd.service"
-            install -Dm0644 systemd/tapauthd.socket "\$pkgdir/usr/lib/systemd/system/tapauthd.socket"
-            install -Dm0644 systemd/polkit-agent-helper@.service.d/tapauth.conf "\$pkgdir/usr/lib/systemd/system/polkit-agent-helper@.service.d/tapauth.conf"
-            install -Dm0644 packaging/sysusers.conf "\$pkgdir/usr/lib/sysusers.d/tapauth.conf"
-            install -Dm0644 packaging/tmpfiles.conf "\$pkgdir/usr/lib/tmpfiles.d/tapauth.conf"
-            install -Dm0644 client-config-gui/tapauth-config.desktop "\$pkgdir/usr/share/applications/tapauth-config.desktop"
-            install -Dm0644 client-config-gui/assets/tapauth-config.svg "\$pkgdir/usr/share/icons/hicolor/scalable/apps/tapauth-config.svg"
-            install -Dm0644 tapauthd/dev.rourunisen.tapauth.config.admin.policy "\$pkgdir/usr/share/polkit-1/actions/dev.rourunisen.tapauth.config.admin.policy"
-            install -Dm0644 packaging/50-tapauthd.rules "\$pkgdir/usr/share/polkit-1/rules.d/50-tapauthd.rules"
-            install -Dm0644 LICENSE "\$pkgdir/usr/share/licenses/\$pkgname/LICENSE"
-          }
-          EOF
-
-          cat > tapauth.install <<EOF
-          post_install() {
-            systemd-sysusers /usr/lib/sysusers.d/tapauth.conf
-            systemd-tmpfiles --create /usr/lib/tmpfiles.d/tapauth.conf
-            systemctl daemon-reload
-            systemctl enable --now tapauthd.socket
-          }
-
-          post_upgrade() {
-            systemd-sysusers /usr/lib/sysusers.d/tapauth.conf
-            systemd-tmpfiles --create /usr/lib/tmpfiles.d/tapauth.conf
-            systemctl daemon-reload
-            systemctl reenable tapauthd.socket
-            systemctl restart tapauthd.socket
-          }
+          cd aur-repo
+          sed -i "s/^pkgver=.*/pkgver=${{ steps.version_vars.outputs.VERSION }}/" PKGBUILD
+          sed -i "s/^sha256sums=.*/sha256sums=('${{ steps.calc_sha.outputs.SHA256 }}')/" PKGBUILD
 
-          pre_remove() {
-            systemctl disable --now tapauthd.socket tapauthd.service 2>/dev/null || true
-          }
-          EOF
+          cd ..
+          # makepkg refuses to run as root — run as a non-root user inside the container
+          docker run --rm -v "$(pwd)/aur-repo:/pkg" archlinux:base-devel \
+            bash -c "useradd -m builder && chown -R builder:builder /pkg && su builder -c 'cd /pkg && makepkg --printsrcinfo > .SRCINFO'"
+          cd aur-repo
 
-          cat > .SRCINFO <<EOF
-          pkgbase = tapauth
-          	pkgdesc = Local smartphone-based authentication framework engine
-          	pkgver = ${{ steps.version_vars.outputs.VERSION }}
-          	pkgrel = 1
-          	url = https://github.com/lolle2000la/tapauth
-          	arch = x86_64
-          	arch = aarch64
-          	license = AGPL-3.0
-          	install = tapauth.install
-          	makedepends = cargo
-          	makedepends = rust
-          	makedepends = protobuf
-          	makedepends = clang
-          	depends = dbus
-          	depends = pam
-          	source = tapauth-${{ steps.version_vars.outputs.VERSION }}.tar.gz::https://github.com/lolle2000la/tapauth/archive/refs/tags/v${{ steps.version_vars.outputs.VERSION }}.tar.gz
-          	sha256sums = ${{ steps.calc_sha.outputs.SHA256 }}
+          git add -A
 
-          pkgname = tapauth
-          EOF
+          if git diff --cached --quiet; then
+            echo "No changes in packaging files. Skipping commit."
+            exit 0
+          fi
 
-          git add PKGBUILD .SRCINFO tapauth.install
           git commit -m "Automated production sync target version: v${{ steps.version_vars.outputs.VERSION }}"
           git push origin master