Ship binary tarball without source payload

ober

9fe7bdecda5775293979d49e2bec51a01881c1db

diff --git a/.build.yml b/.build.yml
index 456d197..19f3e3e 100644
--- a/.build.yml
+++ b/.build.yml
@@ -120,6 +120,10 @@ tasks:
       # that points the loader at the bundled lib/ (Qt backend + Rust crypto).
       tar tzf "$tb" | grep -E 'bin/jerboa-browser\.bin$' \
         || { echo "native binary missing from tarball"; exit 1; }
+      if tar tzf "$tb" | grep -E '(^|/)(scheme|support|vendor)/|/(build-binary\.ss|Makefile|\.jerbuild)$|\.(ss|sls)$'; then
+        echo "source files should not be bundled in the native binary tarball"
+        exit 1
+      fi
       echo "--- native binary ---"
       tar xzf "$tb" -O jerboa-browser-0.0.1-linux-x86_64/bin/jerboa-browser.bin \
         > /tmp/jb && file /tmp/jb
diff --git a/packaging/README.md b/packaging/README.md
index 10d8983..cfeb90c 100644
--- a/packaging/README.md
+++ b/packaging/README.md
@@ -100,16 +100,18 @@ BUNDLE_QT=1 packaging/linux/build-tarball.sh
 make static-qt                        # Docker build, copies ./jerboa-browser-static-qt-linux-amd64.tar.gz
 ```
 
-The tarball bundles the backend `libjerboa_browser.so`, the browser-owned FUSE
-vault helper `libjerboa_fuse_mount.so`, the direct-USB YubiKey backend
-`libyubikey_native.so`, the Jerboa `scheme/` sources, `vendor/jerboa-fuse/`,
-`vendor/jerboa-yubikey/`, the support scripts, and `build-binary.ss` +
-`Makefile`.
-When the Jerboa toolchain (Chez + Jerboa stdlib) is present on the build host it
-also compiles and bundles the self-contained native `bin/jerboa-browser` — a
+The tarball always bundles the backend `libjerboa_browser.so`, the
+browser-owned FUSE vault helper `libjerboa_fuse_mount.so`, and the direct-USB
+YubiKey backend `libyubikey_native.so`.
+When the Jerboa toolchain (Chez + Jerboa stdlib) is present on the build host,
+it also compiles and bundles the self-contained native `bin/jerboa-browser` — a
 Jerboa program with the Chez kernel, boot image, and the `(browser)` library all
-embedded (built by `make binary`/`jerbuild`, **not** a C/C++ launcher);
-otherwise unpack and run `make binary` to produce it.
+embedded (built by `make binary`/`jerbuild`, **not** a C/C++ launcher). In that
+case, Scheme and vendored source files are not included in the tarball.
+If the native binary cannot be built, the tarball falls back to a source package
+with `scheme/`, `vendor/jerboa-fuse/`, `vendor/jerboa-yubikey/`, the support
+scripts, and `build-binary.ss` + `Makefile`; unpack it and run `make binary` to
+produce the executable.
 
 With `BUNDLE_QT=1`, the package also stages Qt libraries, platform plugins,
 `QtWebEngineProcess`, WebEngine `.pak` resources, ICU data, locales, and the
diff --git a/packaging/linux/build-tarball.sh b/packaging/linux/build-tarball.sh
index 761813f..75c67d3 100755
--- a/packaging/linux/build-tarball.sh
+++ b/packaging/linux/build-tarball.sh
@@ -119,6 +119,23 @@ Translations=translations
 EOF
 }
 
+stage_source_fallback() {
+    echo "==> staging source fallback"
+    ( cd "$REPO" && tar --exclude='*.so' --exclude='*.wpo' \
+        --exclude='scheme/browser/build-vault-secret.ss' -cf - scheme ) | \
+        ( cd "$STAGE" && tar -xf - )
+    ( cd "$REPO" && tar --exclude='*.so' --exclude='*.wpo' -cf - vendor/jerboa-fuse ) | \
+        ( cd "$STAGE" && tar -xf - )
+    ( cd "$REPO" && tar --exclude='.git' --exclude='target' --exclude='*/target' \
+        --exclude='*.so' --exclude='*.dylib' --exclude='*.a' --exclude='*.wpo' \
+        -cf - vendor/jerboa-yubikey ) | \
+        ( cd "$STAGE" && tar -xf - )
+    cp -f "$REPO/build-binary.ss" "$REPO/Makefile" "$REPO/.jerbuild" "$STAGE/"
+    mkdir -p "$STAGE/support"
+    cp -f "$REPO/support/ensure-vendor.sh" \
+          "$REPO/support/README.md" "$STAGE/support/"
+}
+
 bundle_qt_runtime() {
     [ "$HAVE_BIN" = 1 ] || {
         echo "BUNDLE_QT=1 requires a native bin/jerboa-browser in the package" >&2
@@ -254,26 +271,14 @@ YUBIKEY_NATIVE="$REPO/lib/libyubikey_native.so"
 
 echo "==> staging tarball tree at $STAGE"
 rm -rf "$STAGE"
-mkdir -p "$STAGE/lib" "$STAGE/bin" "$STAGE/scheme" "$STAGE/support"
+mkdir -p "$STAGE/lib" "$STAGE/bin"
 cp -f "$LIB" "$STAGE/lib/"
 cp -f "$FUSE_SHIM" "$STAGE/lib/"
 cp -f "$YUBIKEY_NATIVE" "$STAGE/lib/"
-( cd "$REPO" && tar --exclude='*.so' --exclude='*.wpo' \
-    --exclude='scheme/browser/build-vault-secret.ss' -cf - scheme ) | \
-    ( cd "$STAGE" && tar -xf - )
-( cd "$REPO" && tar --exclude='*.so' --exclude='*.wpo' -cf - vendor/jerboa-fuse ) | \
-    ( cd "$STAGE" && tar -xf - )
-( cd "$REPO" && tar --exclude='.git' --exclude='target' --exclude='*/target' \
-    --exclude='*.so' --exclude='*.dylib' --exclude='*.a' --exclude='*.wpo' \
-    -cf - vendor/jerboa-yubikey ) | \
-    ( cd "$STAGE" && tar -xf - )
-cp -f "$REPO/build-binary.ss" "$REPO/Makefile" "$REPO/.jerbuild" "$STAGE/"
-cp -f "$REPO/support/ensure-vendor.sh" \
-      "$REPO/support/README.md" "$STAGE/support/"
 
 # The native binary embeds Chez + the (browser) library; build it when the
 # Jerboa toolchain is present (e.g. a developer host). CI images without Chez
-# skip this — the tarball still carries the sources + build-binary.ss.
+# fall back to a source package that can run `make binary` after unpacking.
 HAVE_BIN=0
 HAVE_NATIVE=0
 if [ -x "$SCHEME" ]; then
@@ -330,7 +335,11 @@ WRAP
     fi
 else
     echo "==> Chez/Jerboa not found at $SCHEME — skipping the native binary"
-    echo "    (unpack, then run 'make binary' with the Jerboa toolchain installed)"
+    echo "    (staging sources; unpack, then run 'make binary' with the Jerboa toolchain installed)"
+fi
+
+if [ "$HAVE_BIN" != 1 ]; then
+    stage_source_fallback
 fi
 
 if [ "$BUNDLE_QT" = 1 ]; then
@@ -368,6 +377,15 @@ native_layout_line=""
 if [ "$HAVE_NATIVE" = 1 ]; then
     native_layout_line="  lib/libjerboa_native.so    Rust crypto for the secure store"
 fi
+source_layout_text=""
+if [ "$HAVE_BIN" != 1 ]; then
+    source_layout_text="$(printf '%s\n' \
+        "  scheme/                    the (browser) Jerboa module + entry points" \
+        "  support/                   vendor bootstrap helpers" \
+        "  vendor/jerboa-fuse/        encrypted FUSE vault modules" \
+        "  vendor/jerboa-yubikey/     YubiKey Scheme + native backend source" \
+        "  build-binary.ss, Makefile  build the native binary: \`make binary\`")"
+fi
 
 cat > "$STAGE/README.txt" <<EOF
 Jerboa Browser $VERSION (linux-$ARCH)
@@ -404,11 +422,7 @@ $native_layout_line
   lib/libjerboa_fuse_mount.so browser-owned encrypted vault helper
   lib/libyubikey_native.so   direct USB YubiKey backend
 $bundle_layout_text
-  scheme/                    the (browser) Jerboa module + entry points
-  support/                   vendor bootstrap helpers
-  vendor/jerboa-fuse/        encrypted FUSE vault modules
-  vendor/jerboa-yubikey/     YubiKey Scheme + native backend source
-  build-binary.ss, Makefile  build the native binary: \`make binary\`
+$source_layout_text
 $bin_state_line
 
 The native jerboa-browser binary embeds Chez Scheme, the boot image, and the