Building and releasing

Building and releasing

There is no build step for the app itself — it is plain Python plus native ES modules. Everything here is about producing the packages.

# run it from a checkout
AC_CONFIG=./config.json AC_DOCS=1 uvicorn meow_ac.app:app --host 127.0.0.1 --port 8420

# syntax-check the package without installing the dependencies
python -m py_compile setup_device.py meow_ac/*.py meow_ac/**/*.py

AC_DOCS=1 re-enables /docs for development; it is off by default so a public deployment does not hand out its schema. 127.0.0.1 counts as "the LAN", so you can approve your own pairing locally.

Which ports get rebuilt for a release

Not every port every time. The tiers are deliberate: a release is never blocked on the exotic ones.

Tier 1 — every release, in this order

1. nfpm packages (deb, rpm, pacman, apk) for x86_64 and arm64, the tarballs, and the signed repository.
2. Windows installer and winget manifests.
3. BSD — a FreeBSD .pkg and a NetBSD binary package, built on real BSD machines because their packaging tools do not exist on Linux.
4. OPNsense — the os-breeze-core plugin. Its own build, not the FreeBSD package: OPNsense is FreeBSD:14:amd64 with python311 and neither rust nor pip, so the entire Python runtime is vendored.
5. OpenWrt .ipk feed.

The first two cover almost every real install, which is why they go first.

Tier 2 — occasionally

Termux (Android), every major version or every other. Cheap now that pydantic-core is cross-compiled rather than built under emulation, but never release-blocking.

Tier 3 — frozen unless something major changes

The proof-of-concept architectures — MIPS (OpenWrt and Debian), ppc64le, s390x — stay at whatever version they were last built for, and the published artifacts say so plainly. They are developer aids, not a support commitment. Recipes and every trap: Proof-of-concept architectures.

The container images

Five, each named for what it is, built and smoke-tested by containers/build.sh and containers/test.sh:

containers/build.sh            # all five, into the local docker store
containers/build.sh ubi9-v3    # just one
containers/test.sh --deep      # smoke tests, plus disassembly to prove -march applied

Details and the full trap list: containers/README.md ↗ and Installing with containers.

The signed repository

packaging/repo/build-repo.sh builds the apt/dnf/pacman/apk/opkg tree and signs it; publish.sh uploads it and swaps a symlink atomically, keeping the previous releases for instant rollback. Both refuse to publish a tree with unrendered placeholders or one missing a section the landing page links to — each of those guards exists because the mistake was made once.

Signing keys never leave the maintainer's workstation.

Contributing

Issues and pull requests are welcome — see CONTRIBUTING.md ↗. Vulnerabilities go to SECURITY.md ↗ privately, not into a public issue.