From de57b5dfc21961f5806ad6468b2f4944f12706f0 Mon Sep 17 00:00:00 2001
From: Ryan Hughes <ryan@heyoodle.com>
Date: Sat, 5 Sep 2026 00:03:20 -0400
Subject: [PATCH] Publish only intended package artifacts

---
 bin/push-build | 27 +++++++++++++++++++--------
 build/build.sh | 38 ++++++++++++++++++++++++++++++++------
 2 files changed, 51 insertions(+), 14 deletions(-)

diff --git a/bin/push-build b/bin/push-build
index 5b850126..a4abae99 100755
--- a/bin/push-build
+++ b/bin/push-build
@@ -149,11 +149,16 @@ fi
 # leave nvidia-580xx-dkms and opencl-nvidia-580xx behind. An output's own name
 # still matches, for pushing just one of them on purpose.
 #
-# pkgbase comes from .PKGINFO rather than the PKGBUILD: it is what makepkg
-# actually recorded, and it needs no guessing about which directory built what.
-pkgbase_of() {
+# Package identity comes from .PKGINFO rather than the filename or PKGBUILD: it
+# is what makepkg actually recorded, and it handles epochs and split packages.
+package_identity_of() {
   bsdtar -xOf "$1" .PKGINFO 2>/dev/null |
-    awk -F ' = ' '$1 == "pkgbase" { print $2; exit }'
+    awk -F ' = ' '
+      $1 == "pkgname" { name = $2 }
+      $1 == "pkgbase" { base = $2 }
+      $1 == "pkgver" { version = $2 }
+      END { print name "\t" base "\t" version }
+    '
 }
 
 FILES=()
@@ -161,14 +166,18 @@ if [[ -z "$PACKAGES" ]]; then
   FILES=("${ALL_FILES[@]}")
 else
   declare -A MATCHED=()
+  declare -A LATEST_FILE=()
+  declare -A LATEST_VERSION=()
   for file in "${ALL_FILES[@]}"; do
-    # name-version-release-arch.pkg.tar.zst -> name
-    pkgname="${file%-*-*-*.pkg.tar.*}"
-    pkgbase=$(pkgbase_of "$BUILD_OUTPUT_DIR/$file")
+    IFS=$'\t' read -r pkgname pkgbase pkgver < <(package_identity_of "$BUILD_OUTPUT_DIR/$file")
     for wanted in $PACKAGES; do
       if [[ "$pkgname" == "$wanted" || "$pkgbase" == "$wanted" ]]; then
-        FILES+=("$file")
         MATCHED["$wanted"]=1
+        if [[ -z "${LATEST_FILE[$pkgname]:-}" ]] ||
+          [[ $(vercmp "$pkgver" "${LATEST_VERSION[$pkgname]}") -gt 0 ]]; then
+          LATEST_FILE["$pkgname"]="$file"
+          LATEST_VERSION["$pkgname"]="$pkgver"
+        fi
         break
       fi
     done
@@ -181,6 +190,8 @@ else
       exit 1
     fi
   done
+
+  mapfile -t FILES < <(printf '%s\n' "${LATEST_FILE[@]}" | sort)
 fi
 
 if [[ ${#FILES[@]} -eq 0 ]]; then
diff --git a/build/build.sh b/build/build.sh
index 9357ebd4..9be27162 100755
--- a/build/build.sh
+++ b/build/build.sh
@@ -331,11 +331,39 @@ build_package() {
   if PACMAN=/usr/local/bin/pacman-for-makepkg makepkg "${makepkg_flags[@]}"; then
     # Ensure output directory exists
     mkdir -p "$BUILD_OUTPUT_DIR"
-    
+
+    # Copy only the artifacts makepkg declares as outputs. A PKGBUILD may use
+    # another pacman package as a source (schist-bin does); a *.pkg.tar.* glob
+    # would mistake that source archive for one of our freshly built packages.
+    local -a package_files=()
+    mapfile -t package_files < <(makepkg --packagelist)
+
+    if [[ ${#package_files[@]} -eq 0 ]]; then
+      echo "    Makepkg produced no package files for $pkg"
+      FAILED_PACKAGES="$FAILED_PACKAGES $pkg"
+      return 1
+    fi
+
     local dependency_pkg_file=""
-    for pkg_file in *.pkg.tar.*; do
-      [[ -f "$pkg_file" && "$pkg_file" != *.sig ]] || continue
+    local -a new_pkgs=()
+    local pkg_path pkg_file
+    for pkg_path in "${package_files[@]}"; do
+      pkg_file=${pkg_path##*/}
+      if [[ ! -f "$pkg_file" ]]; then
+        # makepkg predicts an automatic -debug output whenever debug is
+        # enabled, but data-only packages may contain no symbols and therefore
+        # legitimately produce no debug archive.
+        if [[ "$pkg_file" == *-debug-*.pkg.tar.* ]]; then
+          continue
+        fi
+
+        echo "    Expected package file was not produced: $pkg_file"
+        FAILED_PACKAGES="$FAILED_PACKAGES $pkg"
+        return 1
+      fi
+
       cp "$pkg_file" "$BUILD_OUTPUT_DIR/"
+      new_pkgs+=("$pkg_file")
 
       if [[ "$(bsdtar -xOf "$pkg_file" .PKGINFO 2>/dev/null | sed -n 's/^pkgname = //p')" == "$pkg" ]]; then
         dependency_pkg_file="$BUILD_OUTPUT_DIR/$pkg_file"
@@ -344,9 +372,7 @@ build_package() {
 
     cd "$BUILD_OUTPUT_DIR"
 
-    # Find ALL package files (handles split packages)
-    local new_pkgs=($(ls -t ${pkg}-*.pkg.tar.* 2>/dev/null | grep -v '\.sig$' | grep -v 'omarchy-build\.db'))
-
+    # Add every output from this build, including split packages.
     if [[ ${#new_pkgs[@]} -gt 0 ]]; then
       repo-add omarchy-build.db.tar.zst "${new_pkgs[@]}" >/dev/null 2>&1
       ln -sf omarchy-build.db.tar.zst omarchy-build.db