Publish latest Linux build to SourceHut Pages

ober

2ac62afc18f5c2e5fb84e60576dad054f6c55693

diff --git a/.build.yml b/.build.yml
index 2a28239..af4f277 100644
--- a/.build.yml
+++ b/.build.yml
@@ -1,4 +1,5 @@
 image: debian/bookworm
+oauth: pages.sr.ht/PAGES:RW
 packages:
   - cmake
   - g++
@@ -15,6 +16,13 @@ packages:
   - liblz4-dev
   - zlib1g-dev
   - curl
+  # Debian bookworm does not package hut; setup-hut installs it with this.
+  - golang-go
+environment:
+  HUT_VERSION: 82e6f9fd3a5eb9c4365af43a03aecb9d5ac2ea97
+  LATEST_SITE: lisp.srht.site
+  LATEST_SUBDIR: /jerboa-browser/latest
+  LATEST_TARBALL: jerboa-browser-linux-amd64.tar.gz
 sources:
   - https://git.sr.ht/~lisp/jerboa-browser
   # Chez Scheme is vendored in the jerboa repo (vendor/ChezScheme); cloned so CI
@@ -64,6 +72,12 @@ tasks:
           | sh -s -- -y --profile minimal --default-toolchain stable
       fi
       echo 'source "$HOME/.cargo/env"' >> ~/.buildenv
+  - setup-hut: |
+      # bookworm has Go but not hut. Install hut locally so the final task can
+      # publish the verified tarball to pages.sr.ht with the build OAuth grant.
+      mkdir -p "$HOME/.local/bin"
+      GOBIN="$HOME/.local/bin" go install "git.sr.ht/~emersion/hut@$HUT_VERSION"
+      "$HOME/.local/bin/hut" pages publish --help >/dev/null
   - build: |
       cd jerboa-browser
       qmake6 --version || true
@@ -217,3 +231,46 @@ tasks:
       export JERBOA_HOME="$HOME/jerboa" SCHEME="$(command -v scheme)"
       export JERBOA_BROWSER_LIB="$PWD/qt-webengine/build/libjerboa_browser.so"
       make test-adblock
+  - publish-latest: |
+      cd jerboa-browser
+      head_commit="$(git rev-parse HEAD)"
+      main_commit="$(git ls-remote origin refs/heads/main | awk '{print $1}')"
+      test -n "$main_commit" || { echo "cannot resolve origin/main"; exit 1; }
+      if [ "$head_commit" != "$main_commit" ]; then
+        echo "not publishing latest: HEAD $head_commit is not origin/main $main_commit"
+        exit 0
+      fi
+
+      src="qt-webengine/build/jerboa-browser-0.0.1-linux-x86_64.tar.gz"
+      test -f "$src" || { echo "missing package tarball: $src"; exit 1; }
+
+      rm -rf latest-pages latest-assets.tar.gz
+      mkdir -p latest-pages
+      cp "$src" "latest-pages/$LATEST_TARBALL"
+      sha256sum "latest-pages/$LATEST_TARBALL" > latest-pages/SHA256SUMS
+      sha256="$(awk '{print $1}' latest-pages/SHA256SUMS)"
+      size="$(wc -c < "latest-pages/$LATEST_TARBALL" | tr -d ' ')"
+      built="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+      cat > latest-pages/latest.json <<EOF
+      {"artifact":"$LATEST_TARBALL","sha256":"$sha256","size":$size,"commit":"$head_commit","built":"$built"}
+      EOF
+      cat > latest-pages/index.html <<EOF
+      <!doctype html>
+      <html lang="en">
+      <meta charset="utf-8">
+      <title>Jerboa Browser latest Linux amd64 build</title>
+      <h1>Jerboa Browser latest Linux amd64 build</h1>
+      <p><a href="$LATEST_TARBALL">$LATEST_TARBALL</a></p>
+      <p>SHA-256: <code>$sha256</code></p>
+      <p>Commit: <a href="https://git.sr.ht/~lisp/jerboa-browser/commit/$head_commit"><code>$head_commit</code></a></p>
+      <p>Built: <time datetime="$built">$built</time></p>
+      <p><a href="SHA256SUMS">SHA256SUMS</a> | <a href="latest.json">latest.json</a></p>
+      </html>
+      EOF
+      find latest-pages -type f -exec chmod 0644 {} +
+      tar -C latest-pages -czf latest-assets.tar.gz .
+      "$HOME/.local/bin/hut" pages publish \
+        -d "$LATEST_SITE" \
+        -s "$LATEST_SUBDIR" \
+        latest-assets.tar.gz
+      echo "latest Linux amd64 tarball published to https://$LATEST_SITE${LATEST_SUBDIR}/$LATEST_TARBALL"
diff --git a/README.md b/README.md
index 1b073ea..7e5f269 100644
--- a/README.md
+++ b/README.md
@@ -160,6 +160,9 @@ one-file static executable. It includes the native browser binary, the
 `libjerboa_browser.so` backend, the browser vault FUSE helper, Qt
 libraries/plugins, `QtWebEngineProcess`, and WebEngine resource files.
 
+SourceHut CI publishes the latest verified Linux amd64 tarball to
+`https://lisp.srht.site/jerboa-browser/latest/jerboa-browser-linux-amd64.tar.gz`.
+
 The functional suites run offscreen (`QT_QPA_PLATFORM=offscreen`) and hermetic
 (`JWB_TEST_NO_NETWORK=1`), modeled on the jerboa-emacs Qt test harness.