version: never answer for somebody else's git; arch: 0.1.4-3

The v0.1.4 arch packages introduced themselves as 0.1.4-dirty: the
tag's tarball has no .git, makepkg builds it inside the release
box's repository, and git describe walked up and answered for the
outer tree -- mid-release, when the paperwork is honestly dirty.
Found at 0.1.2, diagnosed, and then left unfixed by yours truly.

Two fences now. contrib/version only trusts a .git whose toplevel is
its own root (helps every future tarball). The PKGBUILD exports
GIT_CEILING_DIRECTORIES for build and package (helps regardless of
which contrib/version the pinned tarball carries, which is why the
first rebuild still said -dirty: the fix was outside the tarball).
pkgrel=3; both architectures rebuilt, verified 'slosh 0.1.4', and
republished.

2 files changed, 17 insertions, 2 deletions

diff --git a/contrib/arch/PKGBUILD b/contrib/arch/PKGBUILD
index b61726a..74605b1 100644
--- a/contrib/arch/PKGBUILD
+++ b/contrib/arch/PKGBUILD
@@ -15,7 +15,7 @@
 
 pkgname=slosh
 pkgver=0.1.4
-pkgrel=1
+pkgrel=3
 pkgdesc="Terminal multiplexer: panes, tabs, and sessions you can detach from, on libghostty-vt"
 arch=('x86_64' 'aarch64')
 url="https://slosh.foo"
@@ -57,6 +57,12 @@ prepare() {
 
 build() {
   cd "$pkgname-$pkgver"
+  # The tarball has no .git, and git walks up: built inside some other
+  # repository (our release box builds in a subdirectory of the slosh repo),
+  # contrib/version would describe *that* tree and stamp the package with
+  # whatever state it happens to be in -- "0.1.4-dirty" was this. The
+  # ceiling stops the walk at the build root, so ./VERSION answers.
+  export GIT_CEILING_DIRECTORIES="$srcdir"
   # A hermetic zig cache: nothing under $HOME touched, nothing reused from it.
   export ZIG_GLOBAL_CACHE_DIR="$srcdir/zig-global-cache"
   # The pinned 0.1.2 tarball's Makefile predates TARGET= support, so the
@@ -74,6 +80,8 @@ build() {
 
 package() {
   cd "$pkgname-$pkgver"
+  # make re-derives the version at parse time; same ceiling, same reason.
+  export GIT_CEILING_DIRECTORIES="$srcdir"
   make ZIG="$_zig" DESTDIR="$pkgdir" PREFIX=/usr install
   # MIT, so the license ships with the package; THIRD-PARTY-LICENSES covers
   # what is statically linked in (libghostty-vt, stb_image).
diff --git a/contrib/version b/contrib/version
index 0190a30..b851faa 100755
--- a/contrib/version
+++ b/contrib/version
@@ -22,7 +22,14 @@ set -eu
 root="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
 base="$(cat "$root/VERSION" 2>/dev/null || echo 0.0.0)"
 
-if git -C "$root" rev-parse --git-dir >/dev/null 2>&1; then
+# The .git that answers must be the tree's own. A source tarball extracted
+# *inside* some other repository (makepkg builds in build/arch-pkg/, which
+# is inside ours) has no .git of its own, and git happily walks up and
+# answers for the outer tree -- which is how the v0.1.4 arch package
+# introduced itself as "0.1.4-dirty": the tag's tarball, stamped with the
+# release box's uncommitted paperwork. If the toplevel git names is not us,
+# we are a tarball, and ./VERSION is the honest answer.
+if [ "$(git -C "$root" rev-parse --show-toplevel 2>/dev/null || true)" = "$root" ]; then
     d="$(git -C "$root" describe --tags --match 'v[0-9]*' --dirty 2>/dev/null || true)"
     if [ -n "$d" ]; then
         printf '%s\n' "${d#v}"