public links: point at github.com/sl0p-foo/slosh instead of cgit

GitHub is the public interaction point now. The formula and PKGBUILD
fetch GitHub's /archive/ tarballs (same git-archive bytes, per-ref
stable); the PKGBUILD is bumped to 0.1.2 while at it, and its cd's
drop the v -- GitHub tag archives extract to slosh-X.Y.Z/. The cgit
remote stays for pushing; only published URLs change.

6 files changed, 35 insertions, 26 deletions

diff --git a/contrib/arch/PKGBUILD b/contrib/arch/PKGBUILD
index ef0a0d3..80fa3c4 100644
--- a/contrib/arch/PKGBUILD
+++ b/contrib/arch/PKGBUILD
@@ -1,7 +1,8 @@
 # Maintainer: Peter Geissler <peter@haxx.in>
 #
 # This file lives in contrib/arch/ in the slosh repo and is served raw at
-# https://git.sl0p.foo/slosh.git/plain/contrib/arch/PKGBUILD -- fetch it and
+# https://raw.githubusercontent.com/sl0p-foo/slosh/master/contrib/arch/PKGBUILD
+# -- fetch it and
 # makepkg -si. The same file feeds the self-hosted pacman repository at
 # https://slosh.foo/arch/ (contrib/arch-repo builds it); it would also be the
 # AUR package, but AUR signups are closed while the AUR deals with supply
@@ -13,7 +14,7 @@
 # ZIG_GLOBAL_CACHE_DIR.
 
 pkgname=slosh
-pkgver=0.1.1
+pkgver=0.1.2
 pkgrel=1
 pkgdesc="Terminal multiplexer: panes, tabs, and sessions you can detach from, on libghostty-vt"
 arch=('x86_64' 'aarch64')
@@ -26,8 +27,9 @@ options=('!debug')
 # zig 0.16 specifically: the vendored core states minimum_zig_version 0.16.0,
 # and a newer zig may well reject it -- zig is not yet stable across versions.
 makedepends=('zig')
-source=("$pkgname-v$pkgver.tar.gz::https://git.sl0p.foo/slosh.git/snapshot/$pkgname-v$pkgver.tar.gz")
-sha256sums=('c28545524bff2e1582aae34068512439112db8a03c81b587a813492b6912323c')
+# GitHub's tag archive extracts to $pkgname-$pkgver/ (the v is stripped).
+source=("$pkgname-v$pkgver.tar.gz::https://github.com/sl0p-foo/slosh/archive/refs/tags/v$pkgver.tar.gz")
+sha256sums=('a524d0668f8e9f197c6e27db277400b1877f60e897e76bee5d34f6e59f996d87')
 
 # The Makefile's ZIG default is a developer-machine path; a builder has the
 # real one. Overridable so the package can be test-built where zig lives
@@ -35,7 +37,7 @@ sha256sums=('c28545524bff2e1582aae34068512439112db8a03c81b587a813492b6912323c')
 _zig="${ZIG:-/usr/bin/zig}"
 
 prepare() {
-  cd "$pkgname-v$pkgver"
+  cd "$pkgname-$pkgver"
   # A snapshot has no .git, so contrib/version falls back to ./VERSION -- and
   # in v0.1.1 that file was left at 0.1.0 (fixed since by contrib/release,
   # which bumps and tags as one step). Harmless for later tags: this writes
@@ -44,7 +46,7 @@ prepare() {
 }
 
 build() {
-  cd "$pkgname-v$pkgver"
+  cd "$pkgname-$pkgver"
   # A hermetic zig cache: nothing under $HOME touched, nothing reused from it.
   export ZIG_GLOBAL_CACHE_DIR="$srcdir/zig-global-cache"
   make ZIG="$_zig" vendor
@@ -52,7 +54,7 @@ build() {
 }
 
 package() {
-  cd "$pkgname-v$pkgver"
+  cd "$pkgname-$pkgver"
   make ZIG="$_zig" DESTDIR="$pkgdir" PREFIX=/usr install
   # MIT, so the license ships with the package; THIRD-PARTY-LICENSES covers
   # what is statically linked in (libghostty-vt, stb_image).
diff --git a/contrib/arch/README.md b/contrib/arch/README.md
index dd0b975..685f13c 100644
--- a/contrib/arch/README.md
+++ b/contrib/arch/README.md
@@ -33,15 +33,15 @@ package signatures, and now gets them. The database is signed too, so
 temperament. (x86_64 today; aarch64 when a build machine of that shape
 exists.)
 
-**The PKGBUILD itself** — cgit serves it raw, for anyone who would rather
+**The PKGBUILD itself** — GitHub serves it raw, for anyone who would rather
 build than trust:
 
 ```sh
-curl -fsSLO https://git.sl0p.foo/slosh.git/plain/contrib/arch/PKGBUILD
+curl -fsSLO https://raw.githubusercontent.com/sl0p-foo/slosh/master/contrib/arch/PKGBUILD
 makepkg -si
 ```
 
-The build is offline-clean: the source tarball is the cgit snapshot of the
+The build is offline-clean: the source tarball is GitHub's archive of the
 release tag, which carries the vendored libghostty-vt, and every zig
 dependency in the vendored core's `build.zig.zon` is lazy and unused by the
 VT-only build — `zig build` fetches nothing (verified against a cold
@@ -66,7 +66,7 @@ extended, ship the successor the same two ways and say so loudly.
 After `contrib/release X.Y.Z` (which prints this as a reminder):
 
 1. Bump `pkgver` and `sha256sums` in the PKGBUILD — the hash of
-   `https://git.sl0p.foo/slosh.git/snapshot/slosh-vX.Y.Z.tar.gz`.
+   `https://github.com/sl0p-foo/slosh/archive/refs/tags/vX.Y.Z.tar.gz`.
 2. `contrib/arch-repo` — builds the package, updates the indexes in
    `dist/arch/<carch>/`, and prints the rsync that publishes it.
 3. Commit the PKGBUILD change.
diff --git a/contrib/brew-release b/contrib/brew-release
index dbaf526..b56db32 100755
--- a/contrib/brew-release
+++ b/contrib/brew-release
@@ -20,8 +20,13 @@
 
 set -eu
 
-REPO_URL="${SLOSH_REPO_URL:-https://git.sl0p.foo/slosh.git}"
-SNAP_BASE="${SLOSH_SNAPSHOT_BASE:-https://git.sl0p.foo/slosh.git/snapshot/slosh}"
+REPO_URL="${SLOSH_REPO_URL:-https://github.com/sl0p-foo/slosh.git}"
+# GitHub's on-demand archive of a commit: extracts to slosh-<sha>/, and the
+# bytes have been stable per ref since the Jan 2023 compression incident,
+# which GitHub has since promised not to repeat unannounced. Same trust story
+# the cgit snapshots had, and the same fallback applies if it ever breaks:
+# a `using: :git, revision:` url in the formula, which needs no hash.
+SNAP_BASE="${SLOSH_SNAPSHOT_BASE:-https://github.com/sl0p-foo/slosh/archive}"
 root="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
 FORMULA="$root/contrib/homebrew/slosh.rb"
 TAP=""
@@ -106,7 +111,7 @@ case "$label" in
     *)              version="$mkver-$count-$short" ;;
 esac
 
-url="$SNAP_BASE-$full.tar.gz"
+url="$SNAP_BASE/$full.tar.gz"
 say "ref      $REF -> $full"
 say "version  $version"
 say "url      $url"
diff --git a/contrib/homebrew/README.md b/contrib/homebrew/README.md
index 727be7b..97d74ea 100644
--- a/contrib/homebrew/README.md
+++ b/contrib/homebrew/README.md
@@ -23,8 +23,8 @@ brew tap sl0p-foo/slosh
 brew install slosh
 ```
 
-The explicit URL is only needed because the tap is not on GitHub; brew
-remembers it after the first tap. `brew install --HEAD slosh` builds the tip of
+The tap lives at `github.com/sl0p-foo/homebrew-slosh`, which brew resolves
+from the short name on its own. `brew install --HEAD slosh` builds the tip of
 master instead of the pinned release.
 
 (Getting into `homebrew-core` — plain `brew install slosh`, no tap — has a
@@ -100,8 +100,9 @@ brew audit --strict --tap=sl0p/slosh
   need the zig packages vendored into the tarball or declared as `resource`s.
 - **No LICENSE.** The formula therefore has no `license` stanza. Taps do not
   care; homebrew-core would refuse.
-- **Snapshot tarballs.** cgit generates them on demand; the bytes have been
-  stable across requests and days for a given ref, which is what the `sha256`
-  relies on. If that ever changes, switch the formula to
-  `url "https://git.sl0p.foo/slosh.git", using: :git, revision: "<sha>"`,
+- **Snapshot tarballs.** GitHub generates `/archive/<sha>.tar.gz` on demand;
+  the bytes are stable per ref (and after the Jan 2023 compression incident
+  GitHub committed to keeping them so), which is what the `sha256` relies on.
+  If that ever changes, switch the formula to
+  `url "https://github.com/sl0p-foo/slosh.git", using: :git, revision: "<sha>"`,
   which is content-addressed and needs no hash.
diff --git a/contrib/homebrew/slosh.rb b/contrib/homebrew/slosh.rb
index a31a162..6f3978b 100644
--- a/contrib/homebrew/slosh.rb
+++ b/contrib/homebrew/slosh.rb
@@ -14,13 +14,14 @@
 class Slosh < Formula
   desc "Terminal multiplexer with detachable sessions and programmable pane chrome"
   homepage "https://sl0p.foo"
-  # cgit serves a deterministic snapshot per ref: same ref, same bytes, so the
-  # sha256 below stays honest. Pinned to a full commit id rather than a branch,
-  # because a branch tarball changes under you and brew would keep the stale one.
-  url "https://git.sl0p.foo/slosh.git/snapshot/slosh-5987a7f7adfcde60d7757ad858c7435fdaf479e0.tar.gz"
+  # GitHub's archive of a commit is deterministic per ref: same ref, same
+  # bytes, so the sha256 below stays honest. Pinned to a full commit id rather
+  # than a branch, because a branch tarball changes under you and brew would
+  # keep the stale one.
+  url "https://github.com/sl0p-foo/slosh/archive/5987a7f7adfcde60d7757ad858c7435fdaf479e0.tar.gz"
   version "0.1.2"
   sha256 "a5fc5ee33d8b6813a98b597f241e48d8d424c2f83bd93f30b4abbf1477573fb8"
-  head "https://git.sl0p.foo/slosh.git", branch: "master"
+  head "https://github.com/sl0p-foo/slosh.git", branch: "master"
 
   # zig is the whole toolchain: it compiles the C, builds the vendored
   # libghostty-vt, and links it statically. Nothing is needed at runtime, which
diff --git a/contrib/macos-builder-setup b/contrib/macos-builder-setup
index 6955728..7f1d5a1 100755
--- a/contrib/macos-builder-setup
+++ b/contrib/macos-builder-setup
@@ -37,7 +37,7 @@ CHECK=0
 BUILDER=""
 IDENTITY_CN="${SLOSH_IDENTITY_CN:-Developer ID Application}"
 ZIG_VERSION="${SLOSH_ZIG_VERSION:-0.16.0}"
-REPO_URL="${SLOSH_REPO_URL:-https://git.sl0p.foo/slosh.git}"
+REPO_URL="${SLOSH_REPO_URL:-https://github.com/sl0p-foo/slosh.git}"
 DIR="${SLOSH_BUILDER_DIR:-src/slosh}"
 # Overridable so this script can be rehearsed against a scratch keychain and
 # checkout on the real builder without touching the one that signs releases.