desktop: drop the redundant deb depends, correct the pacman docs

Follow-up to 8a8b2b1, driven by what run 2872's new checks actually printed.

The .deb verification did its job on its first run: tauri already infers
exactly libwebkit2gtk-4.1-0 + libgtk-3-0, so declaring the same two in
tauri.conf.json produced a control file listing each of them twice. Removed
the declaration — verify.sh is the real guard, and it fails the build if
inference ever stops covering what the binary links.

The pacman step revealed ci-tauri carries neither zstd nor bsdtar, so packages
currently ship as .pkg.tar.xz with no .MTREE. Both are working outcomes
(pacman reads xz; only `pacman -Qkk` needs .MTREE), but the docs promised
.zst, so the README, the release notes and ci-requirements.md now describe
what the build actually produces.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

.forgejo/workflows/desktop.yml

@@ -81,9 +81,13 @@ jobs:
       # install.sh hands the .deb to every Debian/Ubuntu user, so the package's
       # Depends must be right BEFORE a release exists. Prints the generated
       # control file and cross-checks it against what the ELF actually needs
-      # (dpkg-shlibdeps). tauri.conf.json declares libwebkit2gtk-4.1-0 + libgtk-3-0
+      # (dpkg-shlibdeps).
-      # explicitly rather than trusting inference alone; there's deliberately no
+      #
-      # appindicator or sqlite dep (tauri features = [], rusqlite is "bundled").
+      # We deliberately do NOT set bundle.linux.deb.depends: run 2872 showed
+      # tauri already infers exactly libwebkit2gtk-4.1-0 + libgtk-3-0, so
+      # declaring them again only produced a control file listing each twice.
+      # This step is the guard instead — if tauri's inference ever stops
+      # covering what the binary links, the build fails here.
       - name: Verify the .deb
         run: bash desktop/packaging/deb/verify.sh
 

ci-requirements.md

@@ -71,8 +71,13 @@ backend/frontend push.
   `bsdtar` (`libarchive-tools`) is used for the pacman package's `.MTREE` when
   present and skipped when not, compression falls back zstd → xz → gzip, and the
   `.deb` clean-container install test runs only if a docker CLI is available.
-  Adding `libarchive-tools` + `zstd` + a docker CLI to `ci-tauri` would upgrade
+  Run 2872 confirmed all three optional tools are ABSENT today, so the current
-  those degraded paths, but none of them block a green build.
+  build takes every fallback: the pacman package ships as `.pkg.tar.xz` with no
+  `.MTREE`, and the `.deb` clean-container install test is skipped. All three are
+  functional outcomes — pacman installs an `.xz` package fine, and only
+  `pacman -Qkk` file verification needs `.MTREE`. Adding `libarchive-tools` +
+  `zstd` + a docker CLI to `ci-tauri` would upgrade these paths; none of them
+  block a green build.
 - **Not verifiable in CI:** the runner is Debian, so the pacman package cannot be
   `pacman -U`-tested here. That step logs `.PKGINFO` + the full file listing so
   the package is auditable from the run log; a real Arch install is the operator's

desktop/packaging/arch/README.md

@@ -1,7 +1,7 @@
 # ThoughtSync desktop — Arch package
 
-A **prebuilt** native pacman package (`.pkg.tar.zst`), published as an asset on
+A **prebuilt** native pacman package, published as an asset on every ThoughtSync
-every ThoughtSync release. Nothing to compile, no toolchain to install.
+release. Nothing to compile, no toolchain to install.
 
 Installing natively on Arch matters for more than tidiness: pacman pulls
 `webkit2gtk-4.1` itself and the app runs against your system's graphics stack,
@@ -18,14 +18,18 @@ pacman system:
 curl -fsSL https://git.fabledsword.com/bvandeusen/thoughtsync/raw/branch/main/desktop/packaging/install.sh | sh
 ```
 
-Or grab the `.pkg.tar.zst` from the
+Or grab the `.pkg.tar.*` from the
 [latest release](https://git.fabledsword.com/bvandeusen/thoughtsync/releases/latest)
 and install it directly:
 
 ```sh
-sudo pacman -U thoughtsync-desktop-*-x86_64.pkg.tar.zst
+sudo pacman -U thoughtsync-desktop-*-x86_64.pkg.tar.*
 ```
 
+The compression suffix depends on what the build image provides — `.zst` when
+`zstd` is installed, otherwise `.xz` (today's builds are `.xz`). pacman reads
+all of them; only the filename differs.
+
 Either way you get:
 
 - `/usr/bin/thoughtsync` — the app

desktop/packaging/publish-release.sh

@@ -76,7 +76,7 @@ first_id() { grep -oE '"id"[[:space:]]*:[[:space:]]*[0-9]+' | head -1 | grep -oE
 echo "==> Creating release for $TAG"
 BODY=$(cat <<JSON
 {"tag_name":"$TAG","name":"ThoughtSync $TAG","draft":false,"prerelease":false,
- "body":"ThoughtSync desktop $TAG.\n\n- **Debian / Ubuntu** — native \`.deb\`\n- **Arch / CachyOS** — native \`.pkg.tar.zst\`\n- **everything else** — \`.AppImage\` (de-bundled graphics: renders on any GPU/Wayland setup)\n\nInstall / update — picks the right one for your system:\n\`\`\`\ncurl -fsSL $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/branch/main/desktop/packaging/install.sh | sh\n\`\`\`"}
+ "body":"ThoughtSync desktop $TAG.\n\n- **Debian / Ubuntu** — native \`.deb\`\n- **Arch / CachyOS** — native \`.pkg.tar.*\`\n- **everything else** — \`.AppImage\` (de-bundled graphics: renders on any GPU/Wayland setup)\n\nInstall / update — picks the right one for your system:\n\`\`\`\ncurl -fsSL $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/branch/main/desktop/packaging/install.sh | sh\n\`\`\`"}
 JSON
 )
 # 409 = a release for this tag already exists (re-run) — fall through to lookup.

desktop/src-tauri/tauri.conf.json

@@ -38,11 +38,6 @@
       "icons/128x128.png",
       "icons/128x128@2x.png",
       "icons/icon.png"
-    ],
+    ]
-    "linux": {
-      "deb": {
-        "depends": ["libwebkit2gtk-4.1-0", "libgtk-3-0"]
-      }
-    }
   }
 }