From 6c35c1a1d36a3503651ce5c475af4960ae695a11 Mon Sep 17 00:00:00 2001
From: cabbage <root@everdream.xyz>
Date: Fri, 11 Sep 2026 09:18:29 +0000
Subject: [PATCH] build: publish linux arm64 release artifacts

---
 docs/operations-runbook.md |  9 ++++++---
 scripts/release            | 10 +++++++---
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/docs/operations-runbook.md b/docs/operations-runbook.md
index 569e0f9..64ec847 100644
--- a/docs/operations-runbook.md
+++ b/docs/operations-runbook.md
@@ -79,11 +79,14 @@ signed:
 
 ```sh
 scripts/release build --version 1.0.0-rc.1
-sha256sum -c dist/rvbox-1.0.0-rc.1/SHA256SUMS
-dist/rvbox-1.0.0-rc.1/rvbox-server-linux-amd64 --version
-dist/rvbox-1.0.0-rc.1/rvc-linux-amd64 --version
+(cd dist/rvbox-1.0.0-rc.1 && sha256sum -c SHA256SUMS)
+dist/rvbox-1.0.0-rc.1/rvbox-server-linux-ARCH --version
+dist/rvbox-1.0.0-rc.1/rvc-linux-ARCH --version
 ```
 
+Replace `ARCH` with `amd64` or `arm64` for the Linux host. Both variants are
+created from the same pinned toolchain and have the same embedded version.
+
 For a Windows-signed release, provide an executable host-side signing hook via
 `--sign-windows-hook /absolute/path/to/hook`. The wrapper invokes it with the
 Windows executable path and version, then records `windows_signed: true` in the
diff --git a/scripts/release b/scripts/release
index 437af8e..30b1243 100755
--- a/scripts/release
+++ b/scripts/release
@@ -13,7 +13,9 @@ usage: scripts/release build --version VERSION [--output DIR] [--sign-windows-ho
 
 Builds a fresh immutable bundle containing:
   rvbox-server-linux-amd64
+  rvbox-server-linux-arm64
   rvc-linux-amd64
+  rvc-linux-arm64
   rvbox-windows-amd64.exe
   SHA256SUMS
   manifest.json
@@ -92,7 +94,9 @@ docker compose -f "$compose_file" run --rm toolchain sh -ec '
 	out=$2
 	flags="-s -w -X main.buildVersion=$version"
 	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags "$flags" -o "$out/rvbox-server-linux-amd64" ./cmd/rvbox-server
+	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags "$flags" -o "$out/rvbox-server-linux-arm64" ./cmd/rvbox-server
 	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags "$flags" -o "$out/rvc-linux-amd64" ./cmd/rvc
+	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags "$flags" -o "$out/rvc-linux-arm64" ./cmd/rvc
 	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -trimpath -ldflags "-H=windowsgui $flags" -o "$out/rvbox-windows-amd64.exe" ./cmd/rvbox
 ' sh "$version" "$container_partial"
 
@@ -102,10 +106,10 @@ if [ -n "$sign_hook" ]; then
 	signed=true
 fi
 
-for artifact in rvbox-server-linux-amd64 rvc-linux-amd64 rvbox-windows-amd64.exe; do
+for artifact in rvbox-server-linux-amd64 rvbox-server-linux-arm64 rvc-linux-amd64 rvc-linux-arm64 rvbox-windows-amd64.exe; do
 	[ -f "$partial/$artifact" ] && [ ! -L "$partial/$artifact" ] || fail "builder did not create regular $artifact"
 	done
-(cd "$partial" && sha256sum rvbox-server-linux-amd64 rvc-linux-amd64 rvbox-windows-amd64.exe) >"$partial/SHA256SUMS"
+(cd "$partial" && sha256sum rvbox-server-linux-amd64 rvbox-server-linux-arm64 rvc-linux-amd64 rvc-linux-arm64 rvbox-windows-amd64.exe) >"$partial/SHA256SUMS"
 {
 	printf '{\n'
 	printf '  "schema": 1,\n'
@@ -115,7 +119,7 @@ for artifact in rvbox-server-linux-amd64 rvc-linux-amd64 rvbox-windows-amd64.exe
 	printf '  "artifacts": "SHA256SUMS"\n'
 	printf '}\n'
 } >"$partial/manifest.json"
-chmod 0755 "$partial/rvbox-server-linux-amd64" "$partial/rvc-linux-amd64" "$partial/rvbox-windows-amd64.exe"
+chmod 0755 "$partial/rvbox-server-linux-amd64" "$partial/rvbox-server-linux-arm64" "$partial/rvc-linux-amd64" "$partial/rvc-linux-arm64" "$partial/rvbox-windows-amd64.exe"
 chmod 0644 "$partial/SHA256SUMS" "$partial/manifest.json"
 mv -- "$partial" "$output"
 trap - EXIT HUP INT TERM