The Arch package

An AUR package was the plan, but AUR signups are closed while the AUR deals with supply chain attacks — so this is self-hosted instead, which turns out to be the better offer: a real pacman repository serves built packages, where the AUR would have handed every user a rebuild.

Two ways in, both fed by the PKGBUILD in this directory:

The repository — binary packages, updated with pacman -Syu like anything else. Packages and the database are signed, so first enroll the signing key:

curl -fsSLO https://slosh.foo/arch/slosh.asc
sudo pacman-key --add slosh.asc
sudo pacman-key --lsign-key 0F67C909938CFFA8A76B59FD8D69B55A0E9056B9

That fingerprint is the thing to check before the --lsign-key: the same key is contrib/arch/slosh.asc in git, so the file fetched from the website can be compared against the one in the source — two channels that would both have to lie. Then, in /etc/pacman.conf:

[slosh]
Server = https://slosh.foo/arch/$arch

and pacman -Sy slosh. No SigLevel override: pacman's default demands package signatures, and now gets them. The database is signed too, so SigLevel = Required DatabaseRequired also works, if that is your temperament. (x86_64 today; aarch64 when a build machine of that shape exists.)

The PKGBUILD itself — cgit serves it raw, for anyone who would rather build than trust:

curl -fsSLO https://git.sl0p.foo/slosh.git/plain/contrib/arch/PKGBUILD
makepkg -si

The build is offline-clean: the source tarball is the cgit snapshot of the release tag, which carries the vendored libghostty-vt, and every zig dependency in the vendored core's build.zig.zon is lazy and unused by the VT-only build — zig build fetches nothing (verified against a cold ZIG_GLOBAL_CACHE_DIR). zig 0.16 comes from extra/zig.

The signing key

ed25519, sign-only, made for exactly this — slosh package signing <slosh@slosh.foo>, fingerprint 0F67C909938CFFA8A76B59FD8D69B55A0E9056B9, expires 2028-08-28. The private half lives in the release machine's GnuPG keyring and nowhere else; contrib/arch-repo refuses to build the repo without it, because an unsigned update would make every enrolled pacman refuse the repo. Before the expiry: gpg --quick-set-expire <fpr> 2y, re-export contrib/arch/slosh.asc, commit, republish — enrolled users pick the extension up with pacman-key --add of the refreshed file (worth a note in release notes when it happens). If the key is ever replaced rather than extended, ship the successor the same two ways and say so loudly.

Updating on a release

After contrib/release X.Y.Z (which prints this as a reminder):

1. Bump pkgver and sha256sums in the PKGBUILD — the hash of https://git.sl0p.foo/slosh.git/snapshot/slosh-vX.Y.Z.tar.gz.
2. contrib/arch-repo — builds the package, updates the indexes in dist/arch/<carch>/, and prints the rsync that publishes it.
3. Commit the PKGBUILD change.

When the AUR reopens

The PKGBUILD is AUR-ready as it stands: clean-chroot/offline safe, nothing self-hosted about it but the hosting. Generate the metadata and push —

cd contrib/arch && makepkg --printsrcinfo > .SRCINFO
git clone ssh://aur@aur.archlinux.org/slosh.git /tmp/aur-slosh
cp PKGBUILD .SRCINFO /tmp/aur-slosh/
cd /tmp/aur-slosh && git add -A && git commit -m "X.Y.Z" && git push

— and keep the repository: the AUR entry is discoverability, the repository is the better install.

Testing without the system zig

The PKGBUILD resolves zig from /usr/bin/zig (what makedepends installs), but honours $ZIG so it can be built where zig lives elsewhere:

ZIG=$HOME/zig-0.16.0/zig makepkg -f -d    # -d: zig is not pacman-installed

(contrib/arch-repo passes the same through, and adds -d on its own when zig is not pacman-installed.)