release #

Version tags (v*) build albedo for Linux x86_64 as one AppImage and as deb, rpm and Arch packages, smoke-test each on a clean distro, and upload them with SHA256SUMS to https://albedo-artifacts.fsn1.your-objectstorage.com/releases/<tag>/ (.tangled/workflows/release.yml). A manual run builds and tests the current commit and uploads nothing.

what is built #

release/build.sh [version] runs release/inside.sh in an Ubuntu 22.04 container (podman or docker) and writes build/release/<version>/. The version is semver without the v; the default is git describe. Downloads and the compiled OTP are cached in ~/.cache/albedo-release (ALBEDO_RELEASE_CACHE).

Everything is bundled except glibc (2.35 or newer: Ubuntu 22.04, Debian 12, current Fedora and Arch; not RHEL 9 or Debian 11). One tree serves every format:

bin/albedo           the CLI (static, CGO_ENABLED=0)
bin/rg               ripgrep (musl, static)
bin/albedo-daemon    release/albedo-daemon: bundled tools first on PATH, then the shipment
lib/albedo/          the sealed daemon shipment (gleam export erlang-shipment)
erlang/              OTP 29, built from source: only the apps the daemon calls,
                     no wx, termcap or other GUI apps, OpenSSL linked into crypto,
                     libstdc++/libgcc linked into the emulator
python/              python-build-standalone 3.11, without tests, Tk, IDLE, crypt
web/                 the web client (ALBEDO_WEB_DIST)

inside.sh refuses to package a tree in which any ELF needs a host library other than glibc (or one the tree ships); NixOS hosts have none of the usual ones, so a missing library shows there first. The shipment is sealed (albedo_daemon:seal_build/1, see runtime.md) after Python is compiled, since sealing hashes the finished tree.

• packages install the tree to /usr/lib/albedo and release/packages/albedo to /usr/bin/albedo, which sets ALBEDO_DAEMON and ALBEDO_WEB_DIST. bin/albedo-daemon beside lib/albedo/albedo is the layout the CLI finds a build seal in, so packaged installs use standbys. nfpm builds all three from release/packages/nfpm.yaml; the maintainer field defaults to nekomimi.pet <meowskulls@nekomimi.pet>; PACKAGE_MAINTAINER overrides it.
• AppImage is the tree plus release/appimage/AppRun, assembled by hand (mksquashfs, then the pinned type2 runtime prepended), never by running appimagetool: a host that registers AppImages with binfmt_misc (NixOS) routes every AppImage, inside containers too, to its own launcher. AppRun runs the CLI with ALBEDO_DAEMON=$APPIMAGE and ALBEDO_APPIMAGE_DAEMON=1, so the CLI starts the daemon by running the image again: the daemon holds its own mount and keeps its files after the CLI exits. ALBEDO_BUILD names the version, because the image path stays the same across upgrades; replace an image by rename, never in place, since a running daemon reads the old file. The AppImage has no seal path the CLI finds, so it boots cold. Its runtime cannot start under an open-file limit below about 1024.

testing #

release/smoke.sh <artifact> <image> installs the artifact on a clean container the way a user would, then checks that the CLI runs, that albedo daemon starts a daemon that outlives it and answers albedo sessions, and that albedo daemon --stop ends it. The e2e suite runs against an AppImage daemon through a wrapper given as ALBEDO_TEST_DAEMON (ALBEDO_APPIMAGE_DAEMON=1 exec <image> "$@"); tests that require the compiled test snapshot's layout fail there by design.

storage #

The bucket lives in a Hetzner project; keys of a project reach every bucket in it. The CI key lives in a separate project with no buckets, so it has no access until the bucket policy grants it: s3:PutObject under releases/ only. The same policy makes releases/ publicly readable and listable (s3:ListBucket with an s3:prefix condition, which Hetzner enforces): ?list-type=2&prefix=releases/&delimiter=/ names one prefix per release. The key reaches CI as the spindle secrets S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY; release/upload.sh signs with curl --aws-sigv4 (awscli misreads Hetzner's error bodies) and passes the key on stdin.