Skip to content

Releasing Antiphon

The whole distribution story hangs off git tags on the canonical repository; versions are never written anywhere else.

Cutting a release

  1. Gate green on master, then tag and push: git tag -s v1.0.0 -m "..." && git push origin v1.0.0.
  2. .builds/release.yml fires on the tag: it builds release binaries --locked, packages antiphon-<tag>-x86_64-linux-gnu.tar.gz (binaries, service units, licence, README) with a sha256 sidecar, and uploads both as tag artefacts on git.sr.ht via the job's git.sr.ht/OBJECTS:RW grant. There is no aarch64 tarball for now; see the note at the foot of this page.
  3. Update the AUR package: follow dist/aur/README.md in the source tree to bump pkgver, run updpkgsums against the real tag archive, and push PKGBUILD/.SRCINFO to the AUR git repository.
  4. Update the Homebrew tap (https://git.sr.ht/~donquinleone/homebrew-antiphon): the formula points at the tag archive (.../archive/<tag>.tar.gz) and carries its sha256, depends on notmuch and a Rust build, and names gnupg in a caveat (OpenPGP is opt-in, so it is not a hard dependency). The formula's version and checksum are stamped from the tag at release time, never written ahead of it. antiphon-git on the AUR tracks master and needs no release-time attention.

The one-command installer

dist/install.sh is served live at https://antiphon.net/install.sh (the apex points at SourceHut pages alongside the landing page; the docs live at docs.antiphon.net). It climbs a ladder and stops at the first rung that fits the machine:

  1. macOS: the tap and brew install antiphon.
  2. Arch: an AUR helper (paru, then yay); with neither present it prints the manual makepkg route and falls through.
  3. Any Linux with nix: nix profile install from the flake.
  4. x86_64 Linux: the latest tag's verified tarball into ${XDG_BIN_HOME:-~/.local/bin}.
  5. Last resort: cargo install --locked from the repository, with named dependencies if cargo is absent.

The site repository carries a byte-identical copy at its root; keep the two in step when the script changes.

aarch64 artefacts

The build fleet currently refuses to boot any arm image ("not available for arch"), so there is no prebuilt aarch64 tarball yet; arm users build natively through the AUR packages, the Nix flake or cargo. Revisit with sr.ht support before promising an arm tarball anywhere.