the agent prints the daemon's version, from the constant the packaging reads

The agent answered --version with "fingerprintd-agent 0.2.2", the string
it was written with, while the daemon's constant went 0.2.3, 0.2.4, 0.2.5:
the subpackage carried the package's version and reported another. The
constant moves from main.cpp into the module both products import, with
its note on what a bump publishes; the two scripts that derive pkgver
from it, the APKBUILD's header and the CI comment name the new file. The
APKBUILD's own pkgver stays a hand-kept copy, which a bump changes too.

.forgejo/workflows/package.yml

@@ -11,7 +11,7 @@ name: package
 # privileged runner: it runs in an alpine:edge container on the ordinary
 # arch-latest runner.
 #
-# Release gating is the version: pkgver comes from implementations/main.cpp,
+# Release gating is the version: pkgver comes from interfaces/Fingerprintd.cppm,
 # the registry answers 409 for an already-published version, and the publish
 # step treats that as "nothing to do" — so pushes only release when the
 # Version constant bumps.

implementations/agent.cpp

@@ -124,7 +124,7 @@ int main(int argc, char** argv) {
     ::setvbuf(stdout, nullptr, _IOLBF, 0);
     std::span<char*> args(argv, static_cast<std::size_t>(argc));
     for (std::string_view a : args.subspan(1)) {
-        if (a == "--version") { std::println("fingerprintd-agent 0.2.2"); return 0; }
+        if (a == "--version") { std::println("fingerprintd-agent {}", fingerprintd::Version); return 0; }
         if (a.starts_with("--config=")) g_configPath = a.substr(9);
     }
     // Root has a session bus about as often as it has a display. Refusing is

implementations/main.cpp

@@ -66,10 +66,6 @@ import Fingerprintd;
 
 namespace {
 
-// Bumping this is what publishes a package: the registry answers 409 for a
-// version it already has, which a build treats as a no-op.
-constexpr const char* Version = "0.2.5";
-
 bool g_verbose = false;
 // 500 ms was the research harness's pace, chosen so a human could read the
 // transcript scroll by. It is not a design. The matcher rejects the early
@@ -3383,7 +3379,7 @@ int RunDaemon() {
     // The session comes up on the worker; the bus answers "still starting"
     // until it posts Ready.
     worker.Start();
-    std::println("fingerprintd {} starting on the system bus", Version);
+    std::println("fingerprintd {} starting on the system bus", fingerprintd::Version);
     g_main_loop_run(g_loop);
 
     worker.Quit();
@@ -3546,7 +3542,7 @@ int main(int argc, char** argv) {
     std::uint32_t gid = 0;
     int frames = 120;
     for (std::string_view a : args.subspan(1)) {
-        if (a == "--version") { std::println("fingerprintd {}", Version); return 0; }
+        if (a == "--version") { std::println("fingerprintd {}", fingerprintd::Version); return 0; }
         if (a == "--daemon") daemon = true;
         if (a == "--probe-tee") probe = true;
         if (a.starts_with("--ta=")) g_taPath = a.substr(5);
@@ -3611,6 +3607,6 @@ int main(int argc, char** argv) {
                  "  --standby-unlock=on|off        unlock the locked session in front by finger,\n"
                  "                                 via logind (default on)\n"
                  "  --sfs-root=DIR --sfs-writable --rpmb-write   storage policy",
-                 Version);
+                 fingerprintd::Version);
     return 1;
 }

interfaces/Fingerprintd.cppm

@@ -12,6 +12,7 @@ the normal world, and reports the matched finger id.
 */
 
 export module Fingerprintd;
+import std;
 export import :Sfs;
 export import :Rpmb;
 export import :Ta;
@@ -20,3 +21,13 @@ export import :Store;
 export import :Tee;
 export import :Sensor;
 export import :Actions;
+
+export namespace fingerprintd {
+    // The release version. The daemon and the agent print it for --version,
+    // and packaging/build-package.sh and packaging/make-bin-tarball.sh read
+    // this line for pkgver, so a bump changes it here and in the APKBUILD and
+    // nowhere else. Bumping it is what publishes a package: the registry
+    // answers 409 for a version it already has, which a build treats as a
+    // no-op.
+    inline constexpr std::string_view Version = "0.2.5";
+}

packaging/APKBUILD

@@ -4,7 +4,7 @@
 # Binary packaging: wraps a crafter-build binary cross-compiled per the
 # README's "Cross-compiling" section into a proper apk — used by this repo's
 # package CI (packaging/build-package.sh, which seds pkgver from
-# implementations/main.cpp) and runnable by hand. The source tarball is
+# interfaces/Fingerprintd.cppm) and runnable by hand. The source tarball is
 # produced by packaging/make-bin-tarball.sh. There is deliberately no
 # source-building aport: the build driver is crafter-build, which is not in
 # Alpine, so an APKBUILD that compiled from source could not be built by

packaging/build-package.sh

@@ -54,10 +54,10 @@ retry() { # retry <description> <cmd...>
 	return 1
 }
 
-# implementations/main.cpp is the version's single source of truth (same
+# interfaces/Fingerprintd.cppm is the version's single source of truth (same
 # derivation as make-bin-tarball.sh)
-VER=$(sed -n 's/.*char\* Version = "\(.*\)".*/\1/p' "$SRC/implementations/main.cpp")
-[ -n "$VER" ] || { echo "cannot read Version from implementations/main.cpp" >&2; exit 1; }
+VER=$(sed -n 's/.*Version = "\(.*\)".*/\1/p' "$SRC/interfaces/Fingerprintd.cppm")
+[ -n "$VER" ] || { echo "cannot read Version from interfaces/Fingerprintd.cppm" >&2; exit 1; }
 echo ">> packaging fingerprintd $VER"
 
 # --- crafter-build: static launcher from the rolling release

packaging/make-bin-tarball.sh

@@ -6,7 +6,7 @@
 # root after a cross build; output lands in the current directory.
 set -eu
 
-VER="${1:-$(sed -n 's/.*char\* Version = "\(.*\)".*/\1/p' implementations/main.cpp)}"
+VER="${1:-$(sed -n 's/.*Version = "\(.*\)".*/\1/p' interfaces/Fingerprintd.cppm)}"
 [ -n "$VER" ] || { echo "could not determine version — pass it as \$1" >&2; exit 1; }
 BIN=$(ls -t bin/fingerprintd-aarch64-*/fingerprintd 2>/dev/null | head -n1)
 [ -n "$BIN" ] || { echo "no aarch64 fingerprintd build found — cross-compile first" >&2; exit 1; }