slosh.git/contrib, branch v0.1.3

gen-docs: the page title separator is a middle dot

2026-09-02T13:17:19Z

themes: pin the attach tag to each palette's muted chrome tone

2026-09-02T13:11:59Z

Every shipped theme names attach_fg explicitly, reusing its own minbar colour -- the default gray suits the dark themes and nothing else, and paper's light ground proved it.

webdemo: version from contrib/version, published by ship

2026-09-02T12:47:30Z

The demo's Makefile said VERSION := 0.1.0 by hand, so the in-browser slosh announced a release two tags old no matter what was built into it. It now derives from contrib/version like every other artifact, suffixed +webdemo so the guest build names itself. And ship gains a website step: the site (demo included) is rebuilt from the tag checkout and published as part of a release, so the demo cannot fall behind again.

shaders: remove the .so plugin loader

2026-09-02T12:43:09Z

The static musl release builds cannot dlopen -- musl compiles it out -- so loadable shader plugins were a feature most shipped binaries could not use. Nothing we ship used it either: every shader in contrib/shaders is an expression. Gone: the dlopen/glob loader in shader.c, shader_dir in the config, the plugin ABI table and entry macro, the Windows dl*/glob shims that existed only for it, the contrib/shader-plugin skeleton, its tests, and every doc mention. shader_abi.h stays as the shader model (cell_t, shade_ctx_t, shader_t) with a note about what it used to be.

contrib/ship: the whole release as one resumable command

2026-09-02T12:15:37Z

contrib/release cuts the tag and stops -- publishing is on purpose. ship is that purpose: push, artifacts (linux/windows here, macOS on the builder), the GitHub release, the brew tap, the arch repo, the paperwork commit. Each step skips when its result already exists, so a run that died mid-way resumes instead of rebuilding artifacts whose checksums are already published. Preflight checks every credential and machine before anything is cut, because half-published is the failure mode this exists to remove (v0.1.2 shipped while the arch repo still served v0.1.1).

public links: point at github.com/sl0p-foo/slosh instead of cgit

2026-09-02T12:07:37Z

GitHub is the public interaction point now. The formula and PKGBUILD fetch GitHub's /archive/ tarballs (same git-archive bytes, per-ref stable); the PKGBUILD is bumped to 0.1.2 while at it, and its cd's drop the v -- GitHub tag archives extract to slosh-X.Y.Z/. The cgit remote stays for pushing; only published URLs change.

brew: pin formula to v0.1.2

2026-09-02T11:01:07Z

point homebrew tap at github.com/sl0p-foo/homebrew-slosh

2026-09-02T10:59:01Z

brew auto-resolves GitHub taps, so the explicit URL is no longer needed: 'brew tap sl0p-foo/slosh' is all users type.

arch: sign the packages and the database, and say whose key

2026-08-29T13:57:54Z

An ed25519 key made for exactly this -- slosh package signing , 0F67C909938CFFA8A76B59FD8D69B55A0E9056B9 -- signs every package and both indexes. The public half travels two ways that would both have to lie: contrib/arch/slosh.asc in git, and /arch/slosh.asc on the website; the READMEs walk through pacman-key --add and --lsign-key, and the [slosh] stanza loses its SigLevel override because pacman's default demands signatures and now gets them. contrib/arch-repo pins the fingerprint, refuses to run without the secret key (an unsigned update would make every enrolled pacman refuse the repo), and now regenerates the index from the directory every time: repo-add skips an entry whose version it already has, so after a same-version rebuild an incremental add left the db describing the previous bytes -- a checksum mismatch for every client. An index rebuilt from disk cannot disagree with disk. Verified end to end with a scratch pacman keyring: enrolled key syncs and downloads under Required DatabaseRequired, unenrolled key is refused at the database.

arch: a self-hosted pacman repository, since the AUR is shut

2026-08-29T13:48:25Z

AUR signups are closed while the AUR deals with supply chain attacks, so the package is published from our own roof -- which is the better offer anyway: a pacman repository serves built packages where the AUR hands every user a rebuild. contrib/aur/ becomes contrib/arch/ (the .SRCINFO goes; it is AUR metadata, regenerated in a minute when signups reopen), and contrib/arch-repo builds the package and maintains the slosh.db / slosh.files indexes in dist/arch//, which rsyncs to /opt/slosh/arch/ on the box. The README and the front page carry the [slosh] stanza; SigLevel is spelled out because the packages are not signed yet and pacman defaults to demanding it.