AUR

Publish to the Arch User Repository

Anodizer generates Arch Linux PKGBUILD and .SRCINFO files and pushes them to the Arch User Repository via SSH. Two package types are supported:

• Binary packages (-bin) install prebuilt binaries from your release archives. Configured via publish.aur.
• Source packages build from source using cargo build. Configured via publish.aur_source (per-crate) or the top-level aur_sources array (project-wide).

Classification

See Release resilience for the full classification table and the Submitter gate semantics.

The required: field

Default: false for both package types — an AUR push failure is logged but does not fail the release.

Set required: true to make the release exit non-zero if this publisher fails:

crates:
  - name: myapp
    publish:
      aur:
        git_url: "ssh://aur@aur.archlinux.org/myapp-bin.git"
        required: true

See Publish overview — the required: field for the full semantics.

Minimal config

Pick one or both. Binary packages distribute prebuilt artifacts; source packages build via cargo.

crates:
  - name: myapp
    publish:
      aur:           # binary package — uses release archive
        git_url: "ssh://aur@aur.archlinux.org/myapp-bin.git"
      aur_source:    # source package — builds via cargo
        git_url: "ssh://aur@aur.archlinux.org/myapp.git"

Full config reference

Binary package (publish.aur)

crates:
  - name: myapp
    publish:
      aur:
        git_url: "ssh://aur@aur.archlinux.org/myapp-bin.git"  # required
        name: myapp-bin              # optional; default: <crate>-bin
        description: ""              # optional
        homepage: ""                 # optional
        license: ""                  # optional; SPDX identifier
        depends: []                  # optional; runtime deps
        optdepends: []               # optional
        conflicts: []                # optional; default: [<base_name>]
        provides: []                 # optional; default: [<base_name>]
        replaces: []                 # optional
        backup: []                   # optional; config files to preserve
        maintainers: []              # optional
        contributors: []             # optional
        rel: "1"                     # optional; pkgrel
        ids: []                      # optional; filter by build IDs
        amd64_variant: v1            # optional; v1 | v2 | v3 | v4
        url_template: ""             # optional; override download URL
        package: ""                  # optional; custom package() body
        install: ""                  # optional; .install file content
        directory: ""                # optional; subdirectory in AUR repo
        private_key: ""              # optional; SSH key path (template)
        git_ssh_command: ""          # optional; custom SSH invocation
        commit_author:
          name: ""
          email: ""
        commit_msg_template: ""      # optional
        skip_upload: false           # optional; true | false | "auto"
        disable: false               # optional

Source package (publish.aur_source)

crates:
  - name: myapp
    publish:
      aur_source:
        git_url: "ssh://aur@aur.archlinux.org/myapp.git"  # optional; write to dist/ if omitted
        name: myapp                  # optional; default: crate name
        description: ""              # optional
        homepage: ""                 # optional
        license: MIT                 # optional
        maintainers: []              # optional
        contributors: []             # optional
        provides: []                 # optional
        conflicts: []                # optional
        depends: []                  # optional
        optdepends: []               # optional
        makedepends: ["rust", "cargo"]  # optional
        backup: []                   # optional
        rel: "1"                     # optional
        prepare: ""                  # optional; custom prepare() body
        build: ""                    # optional; default: cargo build --release --locked
        package: ""                  # optional; custom package() body
        url_template: ""             # optional; source archive URL
        git_ssh_command: ""          # optional
        private_key: ""              # optional
        directory: ""                # optional
        skip_upload: false           # optional; "auto" skips prereleases
        commit_author:
          name: ""
          email: ""
        commit_msg_template: ""      # optional
        arches: []                   # optional; architecture filter
        disable: false               # optional

Authentication

AUR publishing requires SSH access to the AUR git server. See SSH key setup below for setup instructions.

Common gotchas

• Version string hyphens: AUR pkgver does not allow hyphens. Anodizer replaces hyphens with underscores (e.g. 1.0.0-rc1 → 1.0.0_rc1). Ensure your PKGBUILD validators account for this.
• .SRCINFO generated automatically: anodizer generates .SRCINFO alongside the PKGBUILD without running makepkg --printsrcinfo. If you maintain additional AUR metadata outside anodizer, ensure the committed .SRCINFO stays in sync.
• No git_url: if git_url is omitted for source packages, PKGBUILD files are generated in dist/ but not pushed. Useful for local inspection before AUR submission.
• Force-push upstream AUR: upstream AUR push is a force-push that overwrites the branch; it is classified as Submitter because it cannot be rolled back programmatically.

Binary packages (publish.aur)

Binary packages download a prebuilt archive from your release and install the binary. The package name defaults to <crate>-bin following AUR convention.

Minimal config

crates:
  - name: myapp
    publish:
      aur:
        git_url: "ssh://aur@aur.archlinux.org/myapp-bin.git"

Config fields

Full example

crates:
  - name: myapp
    publish:
      aur:
        git_url: "ssh://aur@aur.archlinux.org/myapp-bin.git"
        name: myapp-bin
        description: "A fast CLI tool"
        homepage: "https://github.com/myorg/myapp"
        license: MIT
        depends:
          - glibc
        optdepends:
          - "bash-completion: shell completions"
        maintainers:
          - "Jane Doe <jane@example.com>"
        private_key: "{{ Env.AUR_SSH_KEY }}"
        skip_upload: auto

Generated PKGBUILD

Anodizer generates a PKGBUILD with:

• Per-architecture source arrays (source_x86_64, source_aarch64, etc.) with SHA-256 checksums
• Automatic architecture detection from your Linux build artifacts (x86_64, aarch64, i686, armv7h)
• Version strings with hyphens replaced by underscores (AUR pkgver requirement)
• Download URLs with the version substituted as ${pkgver} for AUR compatibility
• A .SRCINFO file generated alongside the PKGBUILD (no makepkg --printsrcinfo dependency)

The default package() function installs the binary to /usr/bin:

package() {
    install -Dm755 "$srcdir/myapp" "$pkgdir/usr/bin/myapp"
}

Override this with the package field when your archive has a different structure.

Source packages (publish.aur_source)

Source packages download a source tarball and build from source using cargo build. The package name does not have a -bin suffix.

Minimal config

crates:
  - name: myapp
    publish:
      aur_source:
        git_url: "ssh://aur@aur.archlinux.org/myapp.git"

Config fields

Full example

crates:
  - name: myapp
    publish:
      aur_source:
        git_url: "ssh://aur@aur.archlinux.org/myapp.git"
        name: myapp
        description: "A fast CLI tool"
        homepage: "https://github.com/myorg/myapp"
        license: MIT
        depends:
          - glibc
        makedepends:
          - rust
          - cargo
        maintainers:
          - "Jane Doe <jane@example.com>"
        private_key: "{{ Env.AUR_SSH_KEY }}"
        skip_upload: auto

Generated source PKGBUILD

The default source PKGBUILD downloads the GitHub release source tarball and builds with Cargo:

build() {
  cd "$srcdir/myapp-$pkgver"
  cargo build --release --locked
}

package() {
  cd "$srcdir/myapp-$pkgver"
  install -Dm755 "target/release/myapp" "$pkgdir/usr/bin/myapp"
}

If no url_template is set, the source URL defaults to:

https://github.com/<owner>/<project>/archive/refs/tags/<tag>.tar.gz

The owner and project are derived from GitURL and ProjectName template variables.

Top-level aur_sources

For project-wide source packages not tied to a specific crate, use the top-level aur_sources array. This follows the same schema as publish.aur_source and accepts multiple entries:

aur_sources:
  - name: myapp
    git_url: "ssh://aur@aur.archlinux.org/myapp.git"
    description: "A fast CLI tool"
    license: MIT
    makedepends:
      - rust
      - cargo
  - name: myapp-git
    git_url: "ssh://aur@aur.archlinux.org/myapp-git.git"
    description: "A fast CLI tool (git version)"
    license: MIT

Each entry generates its own PKGBUILD and .SRCINFO, written to dist/aur_source/<name>/ and optionally pushed to the configured AUR git URL.

One package name per entry

The AUR keys a package on its name, so two entries that render the same name: would push one PKGBUILD over the other and the second config would ship silently. The pre-publish guard renders every publish.aur, publish.aur_source and aur_sources[] entry (each in its own crate's scope) and fails the release before any push when two or more of them name one package on one push remote. Every entry in the group is named in a single finding:

$ anodizer release --snapshot
...
       Error publisher artifact schema validation failed:
aur: field 'pkgname' — package name 'myapp' is rendered by both crate 'cli' (publish.aur) and aur_sources[0] — two entries sharing one AUR package push one PKGBUILD over the other; give each entry its own `name:`

An entry that is skipped (skip, skip_upload, a falsy if:) pushes nothing and claims no name.

The remote is the entry's git_url:, or ssh://aur@aur.archlinux.org/<name>.git when none is written. Two entries that render one name and push it to two different remotes are two packages, and both are accepted.

SSH key setup

AUR publishing requires SSH access. To configure this:

1. Generate an SSH key (if you do not already have one for AUR):

   ssh-keygen -t ed25519 -f ~/.ssh/aur -N ""

2. Add the public key to your AUR account at https://aur.archlinux.org/account under "SSH Public Key".

3. Reference the private key in your config:

   publish:
     aur:
       git_url: "ssh://aur@aur.archlinux.org/myapp-bin.git"
       private_key: "{{ Env.AUR_SSH_KEY }}"

4. In CI, store the private key as a secret and expose it as an environment variable:

   # GitHub Actions example
   env:
     AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}

Alternatively, use git_ssh_command for full control over the SSH invocation:

publish:
  aur:
    git_url: "ssh://aur@aur.archlinux.org/myapp-bin.git"
    git_ssh_command: "ssh -i /path/to/key -o StrictHostKeyChecking=no"

If neither private_key nor git_ssh_command is set, Anodizer uses the system default SSH configuration (e.g. ~/.ssh/config, ssh-agent).

skip_upload behavior

The skip_upload field controls whether Anodizer pushes to the AUR git repo:

The disable field works similarly but skips the entire stage, including PKGBUILD generation.

Artifact eligibility

anodizer packages only the Linux archives for AUR; every non-Linux target is excluded from the generated PKGBUILD. If a configured AUR build produces no Linux archive, anodizer fails the release (aur: no linux archives matched) rather than emitting an empty PKGBUILD. See Artifact eligibility for the full rule.