feat: enhance RPM packaging support for prerelease versions and update maintainer information

Author: sett4

README.md

@@ -78,8 +78,9 @@ Download them from https://dlib.net/files/ once, then store them in a shared loc
 
 #### Automated releases
 
-- Push a tag that matches `v<MAJOR>.<MINOR>.<PATCH>` (for example `git tag v0.3.0 && git push origin v0.3.0`).
-- The `Release Debian Packages` workflow builds both Debian and Ubuntu `.deb` files via `build/package-deb.sh`, using the numeric portion of the tag as the package version.
+- Push a tag that matches `v<MAJOR>.<MINOR>.<PATCH>` or `v<MAJOR>.<MINOR>.<PATCH>-<prerelease>` (for example `git tag v0.3.0 && git push origin v0.3.0` or `git tag v0.3.0-rc1 && git push origin v0.3.0-rc1`).
+- The `Release Packages` workflow builds both Debian and Ubuntu `.deb` files via `build/package-deb.sh` and Fedora `.rpm` files via `build/package-rpm.sh`, using the tag without the leading `v` as the package version.
+- For RPM prereleases, the generated artifact name keeps the original semver, but the spec normalizes it internally to `Version=<core>` and `Release=0.<release>.<prerelease>` so `rpmbuild` accepts RC tags and upgrade ordering remains correct.
 - When the workflow finishes, GitHub Releases contains `chissu-pam_<version>_debian_amd64.deb`, `chissu-pam_<version>_ubuntu_amd64.deb`, and `chissu-pam_<version>_<distro>_x86_64.rpm` assets attached to that tag. Release notes are auto-generated; edit them manually if more detail is needed.
 - If the workflow fails, fix the issue and click “Re-run jobs” for the tag; assets are replaced when uploads succeed.
 

build/package-deb.sh

@@ -98,7 +98,7 @@ if [[ -z "$VERSION" ]]; then
   exit 1
 fi
 
-MAINTAINER="${CHISSU_PAM_MAINTAINER:-Chissu Maintainers https://github/sett4/chissu-pam}"
+MAINTAINER="${CHISSU_PAM_MAINTAINER:-sett4 <noreply@example.org>}"
 DATERFC=$(date -R)
 DEB_VERSION="${VERSION}-${REVISION}"
 WORK_ROOT="$REPO_ROOT/build/package/work/$DISTRO"

build/package-rpm.sh

@@ -25,6 +25,8 @@ VERSION=""
 RELEASE="1"
 ARCH="x86_64"
 SKIP_BUILD=0
+RPM_VERSION=""
+RPM_RELEASE=""
 if [[ ! -f "$LIB_PATH" ]]; then
   echo "Missing shared installer library at $LIB_PATH" >&2
   exit 1
@@ -88,12 +90,35 @@ if [[ -z "$VERSION" ]]; then
   exit 1
 fi
 
-command -v rpmbuild >/dev/null || { echo "rpmbuild not found" >&2; exit 1; }
-
 log() {
   echo "[package-rpm] $*"
 }
 
+normalize_rpm_version() {
+  local input="$1"
+  local core prerelease
+
+  if [[ "$input" =~ ^([0-9]+\.[0-9]+\.[0-9]+)(-([0-9A-Za-z.]+))?$ ]]; then
+    core="${BASH_REMATCH[1]}"
+    prerelease="${BASH_REMATCH[3]:-}"
+  else
+    echo "Unsupported version format for RPM packaging: $input" >&2
+    echo "Expected <major>.<minor>.<patch> or <major>.<minor>.<patch>-<prerelease>" >&2
+    exit 1
+  fi
+
+  RPM_VERSION="$core"
+  if [[ -n "$prerelease" ]]; then
+    RPM_RELEASE="0.${RELEASE}.${prerelease}"
+  else
+    RPM_RELEASE="$RELEASE"
+  fi
+}
+
+normalize_rpm_version "$VERSION"
+
+command -v rpmbuild >/dev/null || { echo "rpmbuild not found" >&2; exit 1; }
+
 require_build_deps() {
   missing=()
   for pkg in "${BUILD_DEPS[@]}"; do
@@ -167,8 +192,8 @@ cp "$REPO_ROOT/LICENSE" "$STAGING_ROOT/LICENSE"
 
 log "Rendering spec"
 sed \
-  -e "s/__VERSION__/$VERSION/g" \
-  -e "s/__RELEASE__/$RELEASE/g" \
+  -e "s/__VERSION__/$RPM_VERSION/g" \
+  -e "s/__RELEASE__/$RPM_RELEASE/g" \
   -e "s/__ARCH__/$ARCH/g" \
   "$SPEC_TEMPLATE" > "$SPEC_PATH"
 

build/package/rpm/chissu-pam.spec.in

@@ -6,7 +6,7 @@ Release:        __RELEASE__%{?dist}
 Summary:        Infrared-ready facial authentication CLI + PAM helper
 
 License:        LGPL-2.1+
-URL:            https://github.com/sett/chissu-pam
+URL:            https://github.com/sett4/chissu-pam
 Source0:        %{name}-%{version}.tar.gz
 BuildArch:      __ARCH__
 Requires:       dlib, openblas, lapack, gtk3, systemd-libs, curl, bzip2, authselect
@@ -25,7 +25,7 @@ enroll embeddings and wire PAM stacks without compiling from source.
 %install
 rm -rf "%{buildroot}"
 mkdir -p "%{buildroot}"
-cp -pr artifacts/* "%{buildroot}/"
+cp -a artifacts/. "%{buildroot}/"
 
 %files
 %license LICENSE

openspec/specs/packaging-rpm/spec.md

@@ -12,6 +12,11 @@ The repository MUST ship a helper that produces RPM packages via the standard `r
 - **AND** it renders a `.spec` file plus `%post`/`%postun` hooks, then invokes `rpmbuild -bb` so that an `.rpm` is emitted into `dist/` with the distro + architecture encoded in the filename (e.g., `chissu-pam-<version>.<distro>.x86_64.rpm`)
 - **AND** runtime dependencies include `dlib`, `openblas`, `lapack`, `gtk3`, `libudev`, `curl`, and `bzip2`
 
+#### Scenario: Maintainer builds prerelease RPM package
+- **GIVEN** a maintainer runs `build/package-rpm.sh --distro fedora --version 1.2.3-rc1`
+- **THEN** the generated RPM metadata uses `Version: 1.2.3`
+- **AND** it encodes the prerelease label in `Release` as `0.<release>.rc1` so the build is valid and upgrades cleanly to the final `1.2.3` package
+
 ### Requirement: Install-Time Model Download
 RPM packages MUST avoid bundling the dlib weights and instead download them during installation.
 
@@ -51,5 +56,5 @@ The RPM packaging workflow SHALL consume the shared installer templates/library
 #### Scenario: RPM build pulls shared config and hooks
 - **WHEN** `build/package-rpm.sh` stages package files
 - **THEN** it copies the generated config template and any shared hook scripts from the common asset output
+- **AND** it preserves dotfiles such as placeholder `.keep` entries when copying staged assets into `%{buildroot}`
 - **AND** it does not re-define prerequisite package lists or dlib download URLs independently (it reuses the shared library/templates).
-

openspec/specs/release-automation/spec.md

@@ -4,10 +4,10 @@
 TBD - created by archiving change add-release-deb-workflow. Update Purpose after archive.
 ## Requirements
 ### Requirement: Tag-triggered Deb Packages
-GitHub Actions MUST produce Debian-compatible packages whenever a semver tag is pushed.
+GitHub Actions MUST produce Debian-compatible packages whenever a supported semver tag is pushed.
 
 #### Scenario: Tag push builds packages
-- **GIVEN** a tag named `v1.2.3` (pattern `v<major>.<minor>.<patch>`) is pushed to the repository
+- **GIVEN** a tag named `v1.2.3` or `v1.2.3-rc1` (pattern `v<major>.<minor>.<patch>[-<prerelease>]`) is pushed to the repository
 - **THEN** a workflow runs on `ubuntu-latest`, checks out the code, installs packaging dependencies (`debhelper`, `dpkg-dev`, `curl`, `bzip2`, etc.), ensures `CARGO_HOME="$(pwd)/.cargo-home"`, and invokes `build/package-deb.sh --distro debian` and `--distro ubuntu`
 - **AND** the workflow archives the resulting `.deb` artifacts from `dist/`
 
@@ -25,14 +25,15 @@ Maintainers MUST have documentation explaining how to trigger and verify the aut
 
 #### Scenario: README describes tagging flow
 - **WHEN** a maintainer reads the release section
-- **THEN** they learn to push a `v<MAJOR>.<MINOR>.<PATCH>` tag, wait for the workflow, and confirm `.deb` assets on GitHub Releases, including notes about required permissions and how to re-run a failed job.
+- **THEN** they learn to push a `v<MAJOR>.<MINOR>.<PATCH>` or `v<MAJOR>.<MINOR>.<PATCH>-<prerelease>` tag, wait for the workflow, and confirm `.deb`/`.rpm` assets on GitHub Releases, including notes about required permissions and how to re-run a failed job.
 
 ### Requirement: Tag-triggered RPM Packages
-The GitHub Actions release workflow MUST produce RPM artifacts whenever a `v<MAJOR>.<MINOR>.<PATCH>` tag is pushed.
+The GitHub Actions release workflow MUST produce RPM artifacts whenever a supported semver tag is pushed.
 
 #### Scenario: Tag push builds RPMs
-- **WHEN** the release workflow runs for tag `v1.2.3`
+- **WHEN** the release workflow runs for tag `v1.2.3` or `v1.2.3-rc1`
 - **THEN** it installs the necessary RPM tooling (`rpm-build`, `createrepo_c`, etc.) and executes `build/package-rpm.sh` for each supported distro, storing the resulting `.rpm` files under `dist/`
+- **AND** prerelease tags are normalized for RPM metadata by storing the core semver in `Version` and moving the prerelease label into `Release`
 - **AND** failures building the RPM cause the workflow to fail so releases are never missing RPM assets silently
 
 ### Requirement: RPM Release Assets
@@ -42,4 +43,3 @@ GitHub Releases MUST include the RPM artifacts beside the `.deb` files.
 - **WHEN** the workflow publishes assets for tag `v1.2.3`
 - **THEN** it uploads each generated `.rpm` file (e.g., `chissu-pam-1.2.3.fedora.x86_64.rpm`) to the tag’s GitHub Release via the same step that publishes `.deb` files
 - **AND** the workflow surfaces an error if any `.rpm` upload fails so maintainers can rerun the job
-