branrgx · branrgx · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026
diff --git a/.copr/Makefile b/.copr/Makefile
@@ -0,0 +1,7 @@
+# COPR SCM method: make srpm. Run from the repository root.
+.PHONY: srpm
+srpm:
+	dnf -y install rpm-build rpmdevtools
+	mkdir -p "$(outdir)"
+	spectool -g -R bb-auth.spec
+	rpmbuild -bs --define '_srcrpmdir $(outdir)' bb-auth.spec
diff --git a/.github/workflows/arch.yml → .github/workflows/arch.yml.disabled b/.github/workflows/arch.yml → .github/workflows/arch.yml.disabled
diff --git a/.github/workflows/copr-release.yml b/.github/workflows/copr-release.yml
@@ -0,0 +1,30 @@
+name: COPR release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    uses: ./.github/workflows/fedora.yml
+
+  copr:
+    needs: validate
+    if: github.event_name == 'release' && !github.event.release.prerelease
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify COPR of the validated tag
+        env:
+          COPR_WEBHOOK_URL: ${{ secrets.COPR_WEBHOOK_URL }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "$COPR_WEBHOOK_URL" || { echo 'Missing COPR_WEBHOOK_URL secret'; exit 1; }
+          jq '{ref: .release.tag_name, ref_type: "tag", repository: .repository, sender: .sender, master_branch: .repository.default_branch}' \
+            "$GITHUB_EVENT_PATH" > /tmp/copr-event.json
+          curl --fail-with-body --silent --show-error --connect-timeout 15 --max-time 60 \
+            -H 'Content-Type: application/json' -H 'X-GitHub-Event: create' \
+            --data-binary @/tmp/copr-event.json "$COPR_WEBHOOK_URL"
diff --git a/.github/workflows/fedora.yml b/.github/workflows/fedora.yml
@@ -0,0 +1,60 @@
+name: Fedora validation
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    container: fedora:44
+    steps:
+      - name: Install Git for checkout
+        run: dnf -y install git
+      - uses: actions/checkout@v7
+      - name: Install build dependencies
+        run: |
+          dnf -y install rpm-build rpmdevtools dnf-plugins-core git diffutils
+          dnf -y builddep bb-auth.spec
+      - name: Validate version and prepare sources
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          version=$(cat VERSION)
+          spec_version=$(rpmspec -q --qf '%{VERSION}\n' bb-auth.spec | head -n1)
+          test "$version" = "$spec_version"
+          mkdir -p /tmp/rpmbuild/{SOURCES,SPECS,BUILD,BUILDROOT,RPMS,SRPMS}
+          if [[ "$GITHUB_EVENT_NAME" == release ]]; then
+            test "$RELEASE_TAG" = "v$version"
+            spectool -g -C /tmp/rpmbuild/SOURCES bb-auth.spec
+            # Ensure the tag archive matches the checkout being validated.
+            mkdir /tmp/release-source
+            tar -xf "/tmp/rpmbuild/SOURCES/bb-auth-$version.tar.gz" -C /tmp/release-source
+            git archive --prefix="bb-auth-$version/" HEAD | tar -x -C /tmp
+            diff -r "/tmp/bb-auth-$version" "/tmp/release-source/bb-auth-$version"
+          else
+            git archive --prefix="bb-auth-$version/" HEAD | gzip > "/tmp/rpmbuild/SOURCES/bb-auth-$version.tar.gz"
+          fi
+      - name: Build RPM and run tests
+        run: rpmbuild -ba --define '_topdir /tmp/rpmbuild' bb-auth.spec
+      - name: Install RPM and check installed paths
+        shell: bash
+        run: |
+          set -euo pipefail
+          dnf -y install /tmp/rpmbuild/RPMS/*/bb-auth-[0-9]*.rpm
+          test -x /usr/libexec/bb-auth
+          test -x /usr/libexec/bb-auth-fallback
+          test -x /usr/libexec/bb-auth-bootstrap
+          test "$(readlink /usr/libexec/pinentry-bb)" = bb-auth
+          test "$(readlink /usr/libexec/bb-keyring-prompter)" = bb-auth
+          test -f /usr/lib/systemd/user/bb-auth.service
+          test -f /usr/share/dbus-1/services/org.bb.auth.service
+          test -f /usr/share/bb-auth/org.gnome.keyring.SystemPrompter.service
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -6,6 +6,8 @@ string(STRIP ${VER_RAW} VER)
 
 project(bb-auth VERSION ${VER} LANGUAGES C CXX)
 
+include(GNUInstallDirs)
+
 set(CMAKE_CXX_STANDARD 23)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 set(CMAKE_C_STANDARD 11)
@@ -126,7 +128,8 @@ target_compile_definitions(bb-auth
 set(BB_AUTH_GCR_PROMPTER_BINARY "/usr/lib/gcr-prompter" CACHE STRING "Path to the system gcr-prompter binary")
 target_compile_definitions(bb-auth PRIVATE GCR_PROMPTER_BINARY="\\"${BB_AUTH_GCR_PROMPTER_BINARY}\\"")
 
-include(GNUInstallDirs)
+set(BB_AUTH_SYSTEMD_USER_UNIT_DIR "${CMAKE_INSTALL_LIBDIR}/systemd/user"
+    CACHE PATH "Installation directory for systemd user units")
 
 set(LIBEXECDIR ${CMAKE_INSTALL_FULL_LIBEXECDIR})
 set(DATADIR ${CMAKE_INSTALL_FULL_DATADIR})
@@ -262,7 +265,7 @@ install(CODE "
 
 # Install systemd user service
 install(FILES ${CMAKE_BINARY_DIR}/bb-auth.service
-        DESTINATION "${CMAKE_INSTALL_LIBDIR}/systemd/user")
+        DESTINATION "${BB_AUTH_SYSTEMD_USER_UNIT_DIR}")
 
 # Install D-Bus service file
 install(FILES ${CMAKE_BINARY_DIR}/bb-auth-dbus.service

diff --git a/PLAN.md b/PLAN.md
@@ -181,6 +181,8 @@ Do not:
 
 ## Changelog Notes
 
+- 2026-09-10: Added tag-based Fedora RPM packaging, configurable systemd user-unit installation, and Fedora release validation before notifying COPR. Local build gates remain pending until development dependencies are available.
+
 - 2026-02-18: AUR packaging switched to deterministic minimal default (`BB_AUTH_GTK_FALLBACK=OFF`), with optional GTK fallback build via explicit opt-in.
 - 2026-02-18: Removed in-tree GTK provider build/install from core; core packaging/CI now validates minimal Qt-first architecture.
 - 2026-02-18: Added provider conformance test suite and external provider packaging guide.

diff --git a/README.md b/README.md
@@ -1,5 +1,7 @@
 # bb-auth
 
+[![Copr build status](https://copr.fedorainfracloud.org/coprs/branrgx/bb-auth/package/bb-auth/status_image/last_build.png)](https://copr.fedorainfracloud.org/coprs/branrgx/bb-auth/package/bb-auth/)
+
 Unified Linux authentication daemon for:
 
 - polkit (`pkexec`)
@@ -30,12 +32,15 @@ It prefers an external UI provider when available, and falls back to the built-i
 
 ## Install
 
-Arch (AUR):
+Fedora (COPR):
 
 ```bash
-yay -S bb-auth-git
+sudo dnf copr enable branrgx/bb-auth
+sudo dnf install bb-auth
 ```
 
+Fedora packaging and release automation: [Fedora / COPR](docs/FEDORA_COPR.md).
+
 Manual:
 
 ```bash

diff --git a/bb-auth.spec b/bb-auth.spec
@@ -0,0 +1,78 @@
+Name:           bb-auth
+Version:        0.2.1
+Release:        1%{?dist}
+Summary:        Unified polkit, keyring, and pinentry authentication daemon
+
+License:        BSD-3-Clause
+URL:            https://github.com/branrgx/bb-auth
+Source0:        %{url}/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
+
+BuildRequires:  cmake
+BuildRequires:  make
+BuildRequires:  systemd-rpm-macros
+BuildRequires:  gcc
+BuildRequires:  gcc-c++
+BuildRequires:  pkgconfig
+BuildRequires:  qt6-qtbase-devel
+BuildRequires:  polkit-devel
+BuildRequires:  polkit-qt6-1-devel
+BuildRequires:  gcr-devel
+BuildRequires:  glib2-devel
+BuildRequires:  json-glib-devel
+
+Requires:       polkit
+Requires:       polkit-qt6-1
+Requires:       gcr
+Requires:       json-glib
+Requires:       gnome-keyring
+
+%description
+bb-auth is a unified Linux authentication daemon for Polkit,
+GNOME Keyring prompts and GPG pinentry.
+
+It supports external UI providers, allowing desktop shells and other
+interfaces to provide their own authentication frontend while retaining
+a built-in Qt fallback.
+
+%prep
+%autosetup
+test "$(cat VERSION)" = "%{version}"
+
+%build
+%cmake \
+    -DCMAKE_BUILD_TYPE=Release \
+    -DBB_AUTH_SYSTEMD_USER_UNIT_DIR=%{_userunitdir} \
+    -DBB_AUTH_GCR_PROMPTER_BINARY=%{_libexecdir}/gcr-prompter
+
+%cmake_build
+
+%install
+%cmake_install
+
+%check
+QT_QPA_PLATFORM=offscreen QT_STYLE_OVERRIDE=Fusion %ctest
+
+%post
+%systemd_user_post bb-auth.service
+
+%preun
+%systemd_user_preun bb-auth.service
+
+%postun
+%systemd_user_postun bb-auth.service
+
+%files
+%license LICENSE
+%doc README.md
+%{_libexecdir}/bb-auth
+%{_libexecdir}/bb-auth-fallback
+%{_libexecdir}/bb-auth-bootstrap
+%{_libexecdir}/bb-keyring-prompter
+%{_libexecdir}/pinentry-bb
+%{_userunitdir}/bb-auth.service
+%{_datadir}/dbus-1/services/org.bb.auth.service
+%{_datadir}/bb-auth/
+
+%changelog
+* Thu Sep 10 2026 branrgx - 0.2.1-1
+- Initial Fedora COPR package
diff --git a/docs/FEDORA_COPR.md b/docs/FEDORA_COPR.md
@@ -0,0 +1,62 @@
+# Fedora releases and COPR
+
+`bb-auth.spec` downloads `v%{version}` from GitHub. Keep `VERSION`, the
+spec's `Version`, and the release tag synchronized (for example `0.2.1`,
+`0.2.1`, `v0.2.1`). Commit changes before creating the tag. Do not move
+published tags. For a packaging-only rebuild, increment `Release`.
+
+## COPR setup
+
+Create the `bb-auth` project with the `fedora-44-x86_64` chroot, then add
+an SCM package named `bb-auth`:
+
+- Type: Git
+- Clone URL: `https://github.com/branrgx/bb-auth.git`
+- Committish: `main` (the tag event overrides this for release builds)
+- Spec file: `bb-auth.spec`
+- Subdirectory: empty
+- SRPM build method: **make srpm** (uses `.copr/Makefile`)
+- Enable automatic rebuilds for webhook handling.
+
+In COPR Settings → Integrations, copy the **GitHub** webhook URL and append
+`bb-auth/` so version-only tags select the package:
+
+```text
+https://copr.fedorainfracloud.org/webhooks/github/<ID>/<UUID>/bb-auth/
+```
+
+In GitHub Settings → Secrets and variables → Actions, create the repository
+secret `COPR_WEBHOOK_URL` with that URL. Do not register the URL under GitHub
+Webhooks: that would trigger builds before validation. This workflow uses the
+GitHub webhook endpoint, not the custom webhook endpoint.
+
+## Publish
+
+Merge the packaging and workflow changes after CI passes. Update `VERSION`
+and `Version` in the spec together, commit, then create a GitHub release with
+the matching `vX.Y.Z` tag. Both workflows must exist in that tagged commit.
+
+`.github/workflows/fedora.yml` builds, tests, and installs an RPM in Fedora 44
+on pushes to `main` and pull requests. It also exposes `workflow_call` so the
+release workflow can reuse the same validation.
+
+`.github/workflows/copr-release.yml` runs when a release is published. It first
+calls `fedora.yml`, which downloads the release tag archive and checks that it
+matches the checkout before building/testing/installing the RPM. Only after
+validation succeeds does the release workflow send a tag-creation event to
+COPR. Prereleases are validated but do not trigger COPR. A failed validation
+prevents the webhook job from running. The release is validated independently
+of previous `main` runs, so COPR receives the tag that actually passed.
+
+COPR checks out the tag, reads its spec, and downloads the versioned archive
+to build the SRPM. A successful webhook request only means the request was
+accepted; check the resulting build in COPR. If you add supported Fedora
+versions, extend the validation job to cover them before publishing there.
+
+The RPM configures `/usr/libexec/gcr-prompter` and installs the user unit in
+`/usr/lib/systemd/user`, independently of Fedora's `/usr/lib64` library path.
+Container validation does not test interactive authentication in a desktop
+session; check polkit, keyring, and pinentry on Fedora before announcing support.
+
+References: [COPR SCM and webhooks](https://docs.copr.fedorainfracloud.org/user_documentation.html),
+[GitHub release events](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#release).