feat: Add animated flag to Dim

fix: Use apt-get and dpkg instead of apt (which isn't stable in scripts)
fix: Change cargo-deb steps to play nice with the setup-rust action
2026-07-10 00:41:42 +00:00 · 2025-09-10 10:49:20 -04:00 · 2025-09-10 10:12:57 -04:00 · 2025-09-10 09:41:13 -04:00 · 2025-09-10 09:20:01 -04:00 · 2025-09-10 09:13:31 -04:00
49 changed files with 1220 additions and 1151 deletions
@@ -1,104 +0,0 @@
-name: create-manifest
-description: |
-  Create and push a multi-platform Docker manifest from individual platform digests.
-  Handles downloading digests, creating manifest lists, and pushing to registry.
-
-inputs:
-  digest_pattern:
-    description: Glob pattern to match digest artifacts (e.g. "digests-linux-{amd64,arm64}")
-    required: true
-  tag_suffix:
-    description: Suffix to add to all Docker tags (e.g. "-maxperf")
-    required: false
-    default: ""
-  images:
-    description: Container registry images (newline-separated)
-    required: true
-  registry_user:
-    description: Registry username for authentication
-    required: false
-  registry_password:
-    description: Registry password for authentication
-    required: false
-
-outputs:
-  version:
-    description: The version tag created for the manifest
-    value: ${{ steps.meta.outputs.version }}
-  tags:
-    description: All tags created for the manifest
-    value: ${{ steps.meta.outputs.tags }}
-
-runs:
-  using: composite
-  steps:
-    - name: Download digests
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: forgejo/download-artifact@v4
-      with:
-        path: /tmp/digests
-        pattern: ${{ inputs.digest_pattern }}
-        merge-multiple: true
-
-    - name: Login to builtin registry
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/login-action@v3
-      with:
-        registry: ${{ env.BUILTIN_REGISTRY }}
-        username: ${{ inputs.registry_user }}
-        password: ${{ inputs.registry_password }}
-
-    - name: Set up Docker Buildx
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/setup-buildx-action@v3
-      with:
-        # Use persistent BuildKit if BUILDKIT_ENDPOINT is set (e.g. tcp://buildkit:8125)
-        driver: ${{ env.BUILDKIT_ENDPOINT != '' && 'remote' || 'docker-container' }}
-        endpoint: ${{ env.BUILDKIT_ENDPOINT || '' }}
-
-    - name: Extract metadata (tags) for Docker
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      id: meta
-      uses: docker/metadata-action@v5
-      with:
-        tags: |
-          type=semver,pattern={{version}},prefix=v,suffix=${{ inputs.tag_suffix }}
-          type=semver,pattern={{major}}.{{minor}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.0.') }},prefix=v,suffix=${{ inputs.tag_suffix }}
-          type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }},prefix=v,suffix=${{ inputs.tag_suffix }}
-          type=ref,event=branch,prefix=${{ format('refs/heads/{0}', github.event.repository.default_branch) != github.ref && 'branch-' || '' }},suffix=${{ inputs.tag_suffix }}
-          type=ref,event=pr,suffix=${{ inputs.tag_suffix }}
-          type=sha,format=short,suffix=${{ inputs.tag_suffix }}
-          type=raw,value=latest${{ inputs.tag_suffix }},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-        images: ${{ inputs.images }}
-        # default labels & annotations: https://github.com/docker/metadata-action/blob/master/src/meta.ts#L509
-      env:
-        DOCKER_METADATA_ANNOTATIONS_LEVELS: index
-
-    - name: Create manifest list and push
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      working-directory: /tmp/digests
-      shell: bash
-      env:
-        IMAGES: ${{ inputs.images }}
-      run: |
-        IFS=$'\n'
-        IMAGES_LIST=($IMAGES)
-        ANNOTATIONS_LIST=($DOCKER_METADATA_OUTPUT_ANNOTATIONS)
-        TAGS_LIST=($DOCKER_METADATA_OUTPUT_TAGS)
-        for REPO in "${IMAGES_LIST[@]}"; do
-            docker buildx imagetools create \
-              $(for tag in "${TAGS_LIST[@]}"; do echo "--tag"; echo "$tag"; done) \
-              $(for annotation in "${ANNOTATIONS_LIST[@]}"; do echo "--annotation"; echo "$annotation"; done) \
-              $(for reference in *; do printf "$REPO@sha256:%s\n" $reference; done)
-        done
-
-    - name: Inspect image
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      shell: bash
-      env:
-        IMAGES: ${{ inputs.images }}
-      run: |
-        IMAGES_LIST=($IMAGES)
-        for REPO in "${IMAGES_LIST[@]}"; do
-          docker buildx imagetools inspect $REPO:${{ steps.meta.outputs.version }}
-        done
@@ -1,169 +0,0 @@
-name: prepare-docker-build
-description: |
-  Prepare the Docker build environment for Continuwuity builds.
-  Sets up Rust toolchain, Docker Buildx, caching, and extracts metadata for Docker builds.
-
-inputs:
-  platform:
-    description: Target platform (e.g. linux/amd64, linux/arm64)
-    required: true
-  slug:
-    description: Platform slug for artifact naming (e.g. linux-amd64, linux-arm64)
-    required: true
-  target_cpu:
-    description: Target CPU architecture (e.g. haswell, empty for base)
-    required: false
-    default: ""
-  profile:
-    description: Cargo build profile (release or release-max-perf)
-    required: true
-  images:
-    description: Container registry images (newline-separated)
-    required: true
-  registry_user:
-    description: Registry username for authentication
-    required: false
-  registry_password:
-    description: Registry password for authentication
-    required: false
-
-outputs:
-  cpu_suffix:
-    description: CPU suffix for artifact naming
-    value: ${{ steps.cpu-suffix.outputs.suffix }}
-  metadata_labels:
-    description: Docker labels for the image
-    value: ${{ steps.meta.outputs.labels }}
-  metadata_annotations:
-    description: Docker annotations for the image
-    value: ${{ steps.meta.outputs.annotations }}
-
-runs:
-  using: composite
-  steps:
-    - name: Set CPU suffix variable
-      id: cpu-suffix
-      shell: bash
-      run: |
-        if [[ -n "${{ inputs.target_cpu }}" ]]; then
-          echo "suffix=-${{ inputs.target_cpu }}" >> $GITHUB_OUTPUT
-          echo "CPU_SUFFIX=-${{ inputs.target_cpu }}" >> $GITHUB_ENV
-        else
-          echo "suffix=" >> $GITHUB_OUTPUT
-          echo "CPU_SUFFIX=" >> $GITHUB_ENV
-        fi
-
-    - name: Echo matrix configuration
-      shell: bash
-      run: |
-        echo "Platform: ${{ inputs.platform }}"
-        echo "Slug: ${{ inputs.slug }}"
-        echo "Target CPU: ${{ inputs.target_cpu }}"
-        echo "Profile: ${{ inputs.profile }}"
-
-    - name: Install rust
-      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
-      id: rust-toolchain
-      uses: ./.forgejo/actions/rust-toolchain
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-      with:
-        # Use persistent BuildKit if BUILDKIT_ENDPOINT is set (e.g. tcp://buildkit:8125)
-        driver: ${{ env.BUILDKIT_ENDPOINT != '' && 'remote' || 'docker-container' }}
-        endpoint: ${{ env.BUILDKIT_ENDPOINT || '' }}
-
-    - name: Set up QEMU
-      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
-      uses: docker/setup-qemu-action@v3
-
-    - name: Login to builtin registry
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/login-action@v3
-      with:
-        registry: ${{ env.BUILTIN_REGISTRY }}
-        username: ${{ inputs.registry_user }}
-        password: ${{ inputs.registry_password }}
-
-    - name: Extract metadata (labels, annotations) for Docker
-      id: meta
-      uses: docker/metadata-action@v5
-      with:
-        images: ${{ inputs.images }}
-        # default labels & annotations: https://github.com/docker/metadata-action/blob/master/src/meta.ts#L509
-      env:
-        DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
-
-    - name: Get short git commit SHA
-      id: sha
-      shell: bash
-      run: |
-        calculatedSha=$(git rev-parse --short ${{ github.sha }})
-        echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
-        echo "Short SHA: $calculatedSha"
-
-    - name: Get Git commit timestamps
-      shell: bash
-      run: |
-        timestamp=$(git log -1 --pretty=%ct)
-        echo "TIMESTAMP=$timestamp" >> $GITHUB_ENV
-        echo "Commit timestamp: $timestamp"
-
-    - uses: ./.forgejo/actions/timelord
-      id: timelord
-
-    - name: Cache Rust registry
-      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
-      uses: actions/cache@v3
-      with:
-        path: |
-          .cargo/git
-          .cargo/git/checkouts
-          .cargo/registry
-          .cargo/registry/src
-        key: rust-registry-image-${{hashFiles('**/Cargo.lock') }}
-
-    - name: Cache cargo target
-      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
-      id: cache-cargo-target
-      uses: actions/cache@v3
-      with:
-        path: |
-          cargo-target${{ env.CPU_SUFFIX }}-${{ inputs.slug }}-${{ inputs.profile }}
-        key: cargo-target${{ env.CPU_SUFFIX }}-${{ inputs.slug }}-${{ inputs.profile }}-${{hashFiles('**/Cargo.lock') }}-${{steps.rust-toolchain.outputs.rustc_version}}
-
-    - name: Cache apt cache
-      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
-      id: cache-apt
-      uses: actions/cache@v3
-      with:
-        path: |
-          var-cache-apt-${{ inputs.slug }}
-        key: var-cache-apt-${{ inputs.slug }}
-
-    - name: Cache apt lib
-      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
-      id: cache-apt-lib
-      uses: actions/cache@v3
-      with:
-        path: |
-          var-lib-apt-${{ inputs.slug }}
-        key: var-lib-apt-${{ inputs.slug }}
-
-    - name: inject cache into docker
-      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
-      uses: https://github.com/reproducible-containers/buildkit-cache-dance@v3.3.0
-      with:
-        cache-map: |
-          {
-            ".cargo/registry": "/usr/local/cargo/registry",
-            ".cargo/git/db": "/usr/local/cargo/git/db",
-            "cargo-target${{ env.CPU_SUFFIX }}-${{ inputs.slug }}-${{ inputs.profile }}": {
-              "target": "/app/target",
-              "id": "cargo-target${{ env.CPU_SUFFIX }}-${{ inputs.slug }}-${{ inputs.profile }}"
-            },
-            "var-cache-apt-${{ inputs.slug }}": "/var/cache/apt",
-            "var-lib-apt-${{ inputs.slug }}": "/var/lib/apt",
-            "${{ steps.timelord.outputs.database-path }}":"/timelord"
-          }
-        skip-extraction: ${{ steps.cache.outputs.cache-hit }}
@@ -9,7 +9,7 @@ runs:
  - name: Install sccache
    uses: https://git.tomfos.tr/tom/sccache-action@v1
  - name: Configure sccache
-    uses: https://github.com/actions/github-script@v8
+    uses: https://github.com/actions/github-script@v7
    with:
      script: |
        core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
@@ -57,7 +57,7 @@ runs:

    - name: Check for LLVM cache
      id: cache
-      uses: actions/cache@v4
+      uses: https://github.com/actions/cache@v4
      with:
        path: |
          /usr/bin/clang-*
@@ -65,7 +65,7 @@ runs:

    - name: Cache Cargo registry and git
      id: registry-cache
-      uses: actions/cache@v4
+      uses: https://github.com/actions/cache@v4
      with:
        path: |
          .cargo/registry/index
@@ -79,7 +79,7 @@ runs:

    - name: Cache toolchain binaries
      id: toolchain-cache
-      uses: actions/cache@v4
+      uses: https://github.com/actions/cache@v4
      with:
        path: |
          .cargo/bin
@@ -94,7 +94,7 @@ runs:

    - name: Cache build artifacts
      id: build-cache
-      uses: actions/cache@v4
+      uses: https://github.com/actions/cache@v4
      with:
        path: |
          target/**/deps
@@ -1,104 +1,46 @@
 name: timelord
 description: |
-  Use timelord to set file timestamps with git-warp-time fallback for cache misses
+  Use timelord to set file timestamps
 inputs:
  key:
    description: |
      The key to use for caching the timelord data.
-    required: false
-    default: ''
+      This should be unique to the repository and the runner.
+    required: true
+    default: timelord-v0
  path:
    description: |
      The path to the directory to be timestamped.
-    required: false
-    default: ''
-
-outputs:
-  database-path:
-    description: Path to timelord database
-    value: '${{ env.TIMELORD_CACHE_PATH }}'
+      This should be the root of the repository.
+    required: true
+    default: .

 runs:
  using: composite
  steps:
-    - name: Set defaults
+    - name: Cache timelord-cli installation
+      id: cache-timelord-bin
+      uses: actions/cache@v3
+      with:
+        path: ~/.cargo/bin/timelord
+        key: timelord-cli-v3.0.1
+    - name: Install timelord-cli
+      uses: https://github.com/cargo-bins/cargo-binstall@main
+      if: steps.cache-timelord-bin.outputs.cache-hit != 'true'
+    - run: cargo binstall timelord-cli@3.0.1
      shell: bash
-      run: |
-        echo "TIMELORD_KEY=${{ inputs.key || format('timelord-v1-{0}-{1}', github.repository, hashFiles('**/*.rs', '**/Cargo.toml', '**/Cargo.lock')) }}" >> $GITHUB_ENV
-        echo "TIMELORD_PATH=${{ inputs.path || '.' }}" >> $GITHUB_ENV
-        echo "TIMELORD_CACHE_PATH=$HOME/.cache/timelord" >> $GITHUB_ENV
-        echo "PATH=/usr/share/rust/.cargo/bin:$HOME/.cargo/bin:$PATH" >> $GITHUB_ENV
+      if: steps.cache-timelord-bin.outputs.cache-hit != 'true'

-    - name: Restore binary cache
-      id: binary-cache
-      uses: actions/cache/restore@v4
+    - name: Load timelord files
+      uses: actions/cache/restore@v3
      with:
-        path: |
-          /usr/share/rust/.cargo/bin
-          ~/.cargo/bin
-        key: timelord-binaries-v2
-
-    - name: Check if binaries need installation
+        path: /timelord/
+        key: ${{ inputs.key }}
+    - name: Run timelord to set timestamps
      shell: bash
-      id: check-binaries
-      run: |
-        NEED_INSTALL=false
-        if [ ! -e /usr/share/rust/.cargo/bin/timelord ] && [ ! -e ~/.cargo/bin/timelord ]; then
-          echo "timelord-cli not found in /usr/share/rust/.cargo/bin or ~/.cargo/bin, needs installation"
-          NEED_INSTALL=true
-        fi
-        if [ ! -e /usr/share/rust/.cargo/bin/git-warp-time ] && [ ! -e ~/.cargo/bin/git-warp-time ]; then
-          echo "git-warp-time not found in /usr/share/rust/.cargo/bin or ~/.cargo/bin, needs installation"
-          NEED_INSTALL=true
-        fi
-        echo "need-install=$NEED_INSTALL" >> $GITHUB_OUTPUT
-
-    - name: Install timelord-cli and git-warp-time
-      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@v2
+      run: timelord sync --source-dir ${{ inputs.path }} --cache-dir /timelord/
+    - name: Save timelord
+      uses: actions/cache/save@v3
      with:
-        tool: git-warp-time,timelord-cli@3.0.1
-
-    - name: Save binary cache
-      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: actions/cache/save@v4
-      with:
-        path: |
-          /usr/share/rust/.cargo/bin
-          ~/.cargo/bin
-        key: timelord-binaries-v2
-
-
-    - name: Restore timelord cache with fallbacks
-      id: timelord-restore
-      uses: actions/cache/restore@v4
-      with:
-        path: ${{ env.TIMELORD_CACHE_PATH }}
-        key: ${{ env.TIMELORD_KEY }}
-        restore-keys: |
-          timelord-v1-${{ github.repository }}-
-
-    - name: Initialize timestamps on complete cache miss
-      if: steps.timelord-restore.outputs.cache-hit != 'true'
-      shell: bash
-      run: |
-        echo "Complete timelord cache miss - running git-warp-time"
-        git fetch --unshallow
-        if [ "${{ env.TIMELORD_PATH }}" = "." ]; then
-          git-warp-time --quiet
-        else
-          git-warp-time --quiet ${{ env.TIMELORD_PATH }}
-        fi
-        echo "Git timestamps restored"
-
-    - name: Run timelord sync
-      shell: bash
-      run: |
-        mkdir -p ${{ env.TIMELORD_CACHE_PATH }}
-        timelord sync --source-dir ${{ env.TIMELORD_PATH }} --cache-dir ${{ env.TIMELORD_CACHE_PATH }}
-
-    - name: Save updated timelord cache immediately
-      uses: actions/cache/save@v4
-      with:
-        path: ${{ env.TIMELORD_CACHE_PATH }}
-        key: ${{ env.TIMELORD_KEY }}
+        path: /timelord/
+        key: ${{ inputs.key }}
@@ -1,70 +0,0 @@
-name: upload-docker-artifacts
-description: |
-  Upload Docker build artifacts including binary and digest files.
-  Handles artifact naming and conditional digest uploads for registry publishing.
-
-inputs:
-  slug:
-    description: Platform slug for artifact naming (e.g. linux-amd64, linux-arm64)
-    required: true
-  cpu_suffix:
-    description: CPU suffix for artifact naming (e.g. -haswell)
-    required: false
-    default: ""
-  artifact_suffix:
-    description: Suffix for binary artifacts (e.g. -maxperf)
-    required: false
-    default: ""
-  digest_suffix:
-    description: Suffix for digest artifacts (e.g. -maxperf)
-    required: false
-    default: ""
-  digest:
-    description: The digest of the built Docker image
-    required: true
-
-outputs:
-  binary_artifact_name:
-    description: The name of the uploaded binary artifact
-    value: conduwuit${{ inputs.cpu_suffix }}-${{ inputs.slug }}${{ inputs.artifact_suffix }}
-
-runs:
-  using: composite
-  steps:
-    - name: Export digest
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      shell: bash
-      run: |
-        mkdir -p /tmp/digests
-        digest="${{ inputs.digest }}"
-        echo "🔍 Build step digest output: '$digest'"
-        if [[ -z "$digest" ]]; then
-          echo "❌ ERROR: No digest found from build step"
-          exit 1
-        fi
-        digest_file="/tmp/digests/${digest#sha256:}"
-        echo "📁 Creating digest file: $digest_file"
-        touch "$digest_file"
-        echo "✅ Digest file created successfully"
-        echo "📋 Contents of /tmp/digests:"
-        ls -la /tmp/digests/
-
-    - name: Rename extracted binary
-      shell: bash
-      run: mv /tmp/binaries/sbin/conduwuit /tmp/binaries/conduwuit${{ inputs.cpu_suffix }}-${{ inputs.slug }}${{ inputs.artifact_suffix }}
-
-    - name: Upload binary artifact
-      uses: forgejo/upload-artifact@v4
-      with:
-        name: conduwuit${{ inputs.cpu_suffix }}-${{ inputs.slug }}${{ inputs.artifact_suffix }}
-        path: /tmp/binaries/conduwuit${{ inputs.cpu_suffix }}-${{ inputs.slug }}${{ inputs.artifact_suffix }}
-        if-no-files-found: error
-
-    - name: Upload digest
-      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: forgejo/upload-artifact@v4
-      with:
-        name: digests${{ inputs.digest_suffix }}-${{ inputs.slug }}${{ inputs.cpu_suffix }}
-        path: /tmp/digests/*
-        if-no-files-found: error
-        retention-days: 5
@@ -0,0 +1,154 @@
+name: Build / Debian DEB
+
+concurrency:
+  group: "build-debian-${{ forge.ref }}"
+  cancel-in-progress: true
+
+on:
+  push:
+    branches:
+      - '**'
+    tags:
+      - 'v*'
+    paths:
+      - 'pkg/debian/**'
+      - 'src/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.forgejo/workflows/build-debian.yml'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        container: ["ubuntu-latest", "ubuntu-previous", "debian-latest", "debian-oldstable"]
+    container:
+      image: "ghcr.io/tcpipuk/act-runner:${{ matrix.container }}"
+
+    steps:
+      - name: Get Debian version
+        id: debian-version
+        run: |
+          VERSION=$(cat /etc/debian_version)
+          DISTRIBUTION=$(lsb_release -sc 2>/dev/null)
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "distribution=$DISTRIBUTION" >> $GITHUB_OUTPUT
+          echo "Debian distribution: $DISTRIBUTION ($VERSION)"
+
+      - name: Checkout repository with full history
+        uses: https://code.forgejo.org/actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Cache Cargo registry
+        uses: https://code.forgejo.org/actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: cargo-debian-${{ steps.debian-version.outputs.distribution }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-debian-${{ steps.debian-version.outputs.distribution }}-
+
+      - name: Setup sccache
+        uses: https://git.tomfos.tr/tom/sccache-action@v1
+
+      - name: Configure sccache environment
+        run: |
+          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
+          echo "CMAKE_C_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+          echo "CMAKE_CXX_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+          echo "SCCACHE_CACHE_SIZE=10G" >> $GITHUB_ENV
+          # Aggressive GC since cache restores don't increment counter
+          echo "CARGO_INCREMENTAL_GC_TRIGGER=5" >> $GITHUB_ENV
+
+      - name: Setup Rust nightly
+        uses: ./.forgejo/actions/setup-rust
+        with:
+          rust-version: nightly
+          github-token: ${{ secrets.GH_PUBLIC_RO }}
+
+      - name: Get package version and component
+        id: package-meta
+        run: |
+          BASE_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r ".packages[] | select(.name == \"conduwuit\").version" | sed 's/[^a-zA-Z0-9.+]/~/g')
+          # VERSION is the package version, COMPONENT is used in
+          # apt's repository config like a git repo branch
+          if [[ "${{ forge.ref }}" == "refs/tags/"* ]]; then
+            # Use the "stable" component for tagged releases
+            COMPONENT="stable"
+            VERSION=$BASE_VERSION
+          else
+            # Use the "dev" component for development builds
+            SHA=$(echo "${{ forge.sha }}" | cut -c1-7)
+            DATE=$(date +%Y%m%d)
+            if [ "${{ forge.ref_name }}" = "main" ]; then
+              COMPONENT="dev"
+            else
+              # Use the sanitized ref name as the component for feature branches
+              COMPONENT="dev-$(echo '${{ forge.ref_name }}' | sed 's/[^a-zA-Z0-9.+]/-/g' | tr '[:upper:]' '[:lower:]' | cut -c1-30)"
+            fi
+            CLEAN_COMPONENT=$(echo $COMPONENT | sed 's/[^a-zA-Z0-9.+]/~/g')
+            VERSION="$BASE_VERSION~git$DATE.$SHA-$CLEAN_COMPONENT"
+          fi
+          echo "component=$COMPONENT" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Component: $COMPONENT"
+          echo "Version: $VERSION"
+
+      - name: Install cargo-deb
+        run: |
+          if command -v cargo-deb &> /dev/null; then
+            echo "cargo-deb already available"
+          else
+            echo "Installing cargo-deb"
+            cargo-binstall -y --no-symlinks cargo-deb
+          fi
+
+      - name: Install build dependencies
+        run: |
+          apt-get update -y
+          # Build dependencies for rocksdb
+          apt-get install -y clang liburing-dev
+
+      - name: Run cargo-deb
+        id: cargo-deb
+        run: |
+          DEB_PATH=$(cargo deb --deb-version ${{ steps.package-meta.outputs.version }})
+          echo "path=$DEB_PATH" >> $GITHUB_OUTPUT
+
+      - name: Test deb installation
+        run: |
+          echo "Installing: ${{ steps.cargo-deb.outputs.path }}"
+
+          apt-get install -y ${{ steps.cargo-deb.outputs.path }}
+
+          dpkg -s continuwuity
+
+          [ -f /usr/bin/conduwuit ] && echo "✅ Binary installed successfully"
+          [ -f /usr/lib/systemd/system/conduwuit.service ] && echo "✅ Systemd service installed"
+          [ -f /etc/conduwuit/conduwuit.toml ] && echo "✅ Config file installed"
+
+      - name: Upload deb artifact
+        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        with:
+          name: continuwuity-${{ steps.debian-version.outputs.distribution }}
+          path: ${{ steps.cargo-deb.outputs.path }}
+
+      - name: Publish to Forgejo package registry
+        if: ${{ forge.event_name == 'push' || forge.event_name == 'workflow_dispatch' }}
+        run: |
+          OWNER="continuwuation"
+          DISTRIBUTION=${{ steps.debian-version.outputs.distribution }}
+          COMPONENT=${{ steps.package-meta.outputs.component }}
+          DEB=${{ steps.cargo-deb.outputs.path }}
+
+          echo "Publishing: $DEB in component $COMPONENT for distribution $DISTRIBUTION"
+
+          curl --fail-with-body \
+            -X PUT \
+            -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+            --upload-file "$DEB" \
+            "${{ forge.server_url }}/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
@@ -21,7 +21,7 @@ jobs:

    steps:
      - name: Sync repository
-        uses: actions/checkout@v5
+        uses: https://github.com/actions/checkout@v4
        with:
          persist-credentials: false
          fetch-depth: 0
@@ -55,7 +55,7 @@ jobs:

      - name: Setup Node.js
        if: steps.runner-env.outputs.node_major == '' || steps.runner-env.outputs.node_major < '20'
-        uses: https://github.com/actions/setup-node@v5
+        uses: https://github.com/actions/setup-node@v4
        with:
          node-version: 22

@@ -4,14 +4,6 @@ on:
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch:
-  pull_request:
-    paths:
-      - ".forgejo/workflows/element.yml"
-  push:
-    branches:
-      - main
-    paths:
-      - ".forgejo/workflows/element.yml"

 concurrency:
  group: "element-${{ github.ref }}"
@@ -24,7 +16,7 @@ jobs:

    steps:
      - name: 📦 Setup Node.js
-        uses: https://github.com/actions/setup-node@v5
+        uses: https://github.com/actions/setup-node@v4
        with:
          node-version: "22"

@@ -109,7 +101,7 @@ jobs:
          cat ./element-web/webapp/config.json

      - name: 📤 Upload Artifact
-        uses: forgejo/upload-artifact@v4
+        uses: https://code.forgejo.org/actions/upload-artifact@v3
        with:
          name: element-web
          path: ./element-web/webapp/
@@ -26,7 +26,7 @@ jobs:
      GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
        with:
          persist-credentials: false

@@ -16,7 +16,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
        with:
          persist-credentials: false

@@ -47,7 +47,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
        with:
          persist-credentials: false

@@ -29,12 +29,49 @@ on:
 env:
  BUILTIN_REGISTRY: forgejo.ellis.link
  BUILTIN_REGISTRY_ENABLED: "${{ ((vars.BUILTIN_REGISTRY_USER && secrets.BUILTIN_REGISTRY_PASSWORD) || (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false)) && 'true' || 'false' }}"
-  IMAGE_PATH: forgejo.ellis.link/continuwuation/continuwuity

 jobs:
-  build-release:
-    name: "Build ${{ matrix.slug }} (release)"
+  define-variables:
+    runs-on: ubuntu-latest
+
+    outputs:
+      images: ${{ steps.var.outputs.images }}
+      images_list: ${{ steps.var.outputs.images_list }}
+      build_matrix: ${{ steps.var.outputs.build_matrix }}
+
+    steps:
+      - name: Setting variables
+        uses: https://github.com/actions/github-script@v7
+        id: var
+        with:
+          script: |
+            const githubRepo = '${{ github.repository }}'.toLowerCase()
+            const repoId = githubRepo.split('/')[1]
+
+            core.setOutput('github_repository', githubRepo)
+            const builtinImage = '${{ env.BUILTIN_REGISTRY }}/' + githubRepo
+            let images = []
+            if (process.env.BUILTIN_REGISTRY_ENABLED === "true") {
+              images.push(builtinImage)
+            } else {
+              // Fallback to official registry for forks/PRs without credentials
+              images.push('forgejo.ellis.link/continuwuation/continuwuity')
+            }
+            core.setOutput('images', images.join("\n"))
+            core.setOutput('images_list', images.join(","))
+            const platforms = ['linux/amd64', 'linux/arm64']
+            core.setOutput('build_matrix', JSON.stringify({
+              platform: platforms,
+              target_cpu: ['base'],
+              include: platforms.map(platform => { return {
+                platform,
+                slug: platform.replace('/', '-')
+              }})
+            }))
+
+  build-image:
    runs-on: dind
+    needs: define-variables
    permissions:
      contents: read
      packages: write
@@ -42,28 +79,133 @@ jobs:
      id-token: write
    strategy:
      matrix:
-        include:
-          - platform: "linux/amd64"
-            slug: "linux-amd64"
-          - platform: "linux/arm64"
-            slug: "linux-arm64"
+        {
+          "target_cpu": ["base"],
+          "profile": ["release"],
+          "include":
+            [
+              { "platform": "linux/amd64", "slug": "linux-amd64" },
+              { "platform": "linux/arm64", "slug": "linux-arm64" },
+            ],
+          "platform": ["linux/amd64", "linux/arm64"],
+        }

    steps:
+      - name: Echo strategy
+        run: echo '${{ toJSON(fromJSON(needs.define-variables.outputs.build_matrix)) }}'
+      - name: Echo matrix
+        run: echo '${{ toJSON(matrix) }}'
+
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
        with:
          persist-credentials: false
-      - name: Prepare Docker build environment
-        id: prepare
-        uses: ./.forgejo/actions/prepare-docker-build
+      - name: Install rust
+        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
+        id: rust-toolchain
+        uses: ./.forgejo/actions/rust-toolchain
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
        with:
-          platform: ${{ matrix.platform }}
-          slug: ${{ matrix.slug }}
-          target_cpu: ""
-          profile: "release"
-          images: ${{ env.IMAGE_PATH }}
-          registry_user: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
-          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
+          # Use persistent BuildKit if BUILDKIT_ENDPOINT is set (e.g. tcp://buildkit:8125)
+          driver: ${{ env.BUILDKIT_ENDPOINT != '' && 'remote' || 'docker-container' }}
+          endpoint: ${{ env.BUILDKIT_ENDPOINT || '' }}
+      - name: Set up QEMU
+        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
+        uses: docker/setup-qemu-action@v3
+      # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
+      - name: Login to builtin registry
+        if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.BUILTIN_REGISTRY }}
+          username: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
+          password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
+
+      # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
+      - name: Extract metadata (labels, annotations) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{needs.define-variables.outputs.images}}
+          # default labels & annotations: https://github.com/docker/metadata-action/blob/master/src/meta.ts#L509
+        env:
+          DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
+
+      # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
+      # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
+      # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
+      # It will not push images generated from a pull request
+      - name: Get short git commit SHA
+        id: sha
+        run: |
+          calculatedSha=$(git rev-parse --short ${{ github.sha }})
+          echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
+          echo "Short SHA: $calculatedSha"
+      - name: Get Git commit timestamps
+        run: |
+          timestamp=$(git log -1 --pretty=%ct)
+          echo "TIMESTAMP=$timestamp" >> $GITHUB_ENV
+          echo "Commit timestamp: $timestamp"
+
+      - uses: ./.forgejo/actions/timelord
+        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
+        with:
+          key: timelord-v0
+          path: .
+
+      - name: Cache Rust registry
+        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
+        uses: actions/cache@v3
+        with:
+          path: |
+            .cargo/git
+            .cargo/git/checkouts
+            .cargo/registry
+            .cargo/registry/src
+          key: rust-registry-image-${{hashFiles('**/Cargo.lock') }}
+      - name: Cache cargo target
+        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
+        id: cache-cargo-target
+        uses: actions/cache@v3
+        with:
+          path: |
+            cargo-target-${{ matrix.target_cpu }}-${{ matrix.slug }}-${{ matrix.profile }}
+          key: cargo-target-${{ matrix.target_cpu }}-${{ matrix.slug }}-${{ matrix.profile }}-${{hashFiles('**/Cargo.lock') }}-${{steps.rust-toolchain.outputs.rustc_version}}
+      - name: Cache apt cache
+        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
+        id: cache-apt
+        uses: actions/cache@v3
+        with:
+          path: |
+            var-cache-apt-${{ matrix.slug }}
+          key: var-cache-apt-${{ matrix.slug }}
+      - name: Cache apt lib
+        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
+        id: cache-apt-lib
+        uses: actions/cache@v3
+        with:
+          path: |
+            var-lib-apt-${{ matrix.slug }}
+          key: var-lib-apt-${{ matrix.slug }}
+      - name: inject cache into docker
+        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
+        uses: https://github.com/reproducible-containers/buildkit-cache-dance@v3.3.0
+        with:
+          cache-map: |
+            {
+              ".cargo/registry": "/usr/local/cargo/registry",
+              ".cargo/git/db": "/usr/local/cargo/git/db",
+              "cargo-target-${{ matrix.target_cpu }}-${{ matrix.slug }}-${{ matrix.profile }}": {
+                "target": "/app/target",
+                "id": "cargo-target-${{ matrix.target_cpu }}-${{ matrix.slug }}-${{ matrix.profile }}"
+              },
+              "var-cache-apt-${{ matrix.slug }}": "/var/cache/apt",
+              "var-lib-apt-${{ matrix.slug }}": "/var/lib/apt"
+            }
+          skip-extraction: ${{ steps.cache.outputs.cache-hit }}
+
      - name: Build and push Docker image by digest
        id: build
        uses: docker/build-push-action@v6
@@ -75,130 +217,117 @@ jobs:
            GIT_COMMIT_HASH_SHORT=${{ env.COMMIT_SHORT_SHA }}
            GIT_REMOTE_URL=${{github.event.repository.html_url }}
            GIT_REMOTE_COMMIT_URL=${{github.event.head_commit.url }}
-            CARGO_INCREMENTAL=${{ env.BUILDKIT_ENDPOINT != '' && '1' || '0' }}
-            TARGET_CPU=
-            RUST_PROFILE=release
          platforms: ${{ matrix.platform }}
-          labels: ${{ steps.prepare.outputs.metadata_labels }}
-          annotations: ${{ steps.prepare.outputs.metadata_annotations }}
+          labels: ${{ steps.meta.outputs.labels }}
+          annotations: ${{ steps.meta.outputs.annotations }}
          cache-from: type=gha
          # cache-to: type=gha,mode=max
          sbom: true
          outputs: |
-            ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' && format('type=image,"name={0}",push-by-digest=true,name-canonical=true,push=true', env.IMAGE_PATH) || format('type=image,"name={0}",push=false', env.IMAGE_PATH) }}
+            ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' && format('type=image,"name={0}",push-by-digest=true,name-canonical=true,push=true', needs.define-variables.outputs.images_list) || format('type=image,"name={0}",push=false', needs.define-variables.outputs.images_list) }}
            type=local,dest=/tmp/binaries
        env:
          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
-      - name: Upload Docker artifacts
-        uses: ./.forgejo/actions/upload-docker-artifacts
-        with:
-          slug: ${{ matrix.slug }}
-          cpu_suffix: ${{ steps.prepare.outputs.cpu_suffix }}
-          artifact_suffix: ""
-          digest_suffix: ""
-          digest: ${{ steps.build.outputs.digest }}

-  merge-release:
-    name: "Create Multi-arch Release Manifest"
+      # For publishing multi-platform manifests
+      - name: Export digest
+        if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      # Binary extracted via local output for all builds
+      - name: Rename extracted binary
+        run: mv /tmp/binaries/sbin/conduwuit /tmp/binaries/conduwuit-${{ matrix.target_cpu }}-${{ matrix.slug }}-${{ matrix.profile }}
+
+      - name: Upload binary artifact
+        uses: forgejo/upload-artifact@v4
+        with:
+          name: conduwuit-${{ matrix.target_cpu }}-${{ matrix.slug }}-${{ matrix.profile }}
+          path: /tmp/binaries/conduwuit-${{ matrix.target_cpu }}-${{ matrix.slug }}-${{ matrix.profile }}
+          if-no-files-found: error
+
+      - name: Upload digest
+        if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+        uses: forgejo/upload-artifact@v4
+        with:
+          name: digests-${{ matrix.slug }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 5
+
+  merge:
    runs-on: dind
-    needs: build-release
+    needs: [define-variables, build-image]
    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
+      - name: Download digests
+        if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+        uses: forgejo/download-artifact@v4
        with:
-          persist-credentials: false
-      - name: Create multi-platform manifest
-        uses: ./.forgejo/actions/create-docker-manifest
+          path: /tmp/digests
+          pattern: digests-*
+          merge-multiple: true
+      # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
+      - name: Login to builtin registry
+        if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+        uses: docker/login-action@v3
        with:
-          digest_pattern: "digests-linux-{amd64,arm64}"
-          tag_suffix: ""
-          images: ${{ env.IMAGE_PATH }}
-          registry_user: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
-          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
+          registry: ${{ env.BUILTIN_REGISTRY }}
+          username: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
+          password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}

-  build-maxperf:
-    name: "Build ${{ matrix.slug }} (max-perf)"
-    runs-on: dind
-    needs: build-release
-    permissions:
-      contents: read
-      packages: write
-      attestations: write
-      id-token: write
-    strategy:
-      matrix:
-        include:
-          - platform: "linux/amd64"
-            slug: "linux-amd64"
-            target_cpu: "haswell"
-          - platform: "linux/arm64"
-            slug: "linux-arm64"
-            target_cpu: ""
+      - name: Set up Docker Buildx
+        if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+        uses: docker/setup-buildx-action@v3
+        with:
+          # Use persistent BuildKit if BUILDKIT_ENDPOINT is set (e.g. tcp://buildkit:8125)
+          driver: ${{ env.BUILDKIT_ENDPOINT != '' && 'remote' || 'docker-container' }}
+          endpoint: ${{ env.BUILDKIT_ENDPOINT || '' }}

-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
+      - name: Extract metadata (tags) for Docker
+        if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+        id: meta
+        uses: docker/metadata-action@v5
        with:
-          persist-credentials: false
-      - name: Prepare max-perf Docker build environment
-        id: prepare
-        uses: ./.forgejo/actions/prepare-docker-build
-        with:
-          platform: ${{ matrix.platform }}
-          slug: ${{ matrix.slug }}
-          target_cpu: ${{ matrix.target_cpu }}
-          profile: "release-max-perf"
-          images: ${{ env.IMAGE_PATH }}
-          registry_user: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
-          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
-      - name: Build and push max-perf Docker image by digest
-        id: build
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: "docker/Dockerfile"
-          build-args: |
-            GIT_COMMIT_HASH=${{ github.sha }}
-            GIT_COMMIT_HASH_SHORT=${{ env.COMMIT_SHORT_SHA }}
-            GIT_REMOTE_URL=${{github.event.repository.html_url }}
-            GIT_REMOTE_COMMIT_URL=${{github.event.head_commit.url }}
-            CARGO_INCREMENTAL=${{ env.BUILDKIT_ENDPOINT != '' && '1' || '0' }}
-            TARGET_CPU=${{ matrix.target_cpu }}
-            RUST_PROFILE=release-max-perf
-          platforms: ${{ matrix.platform }}
-          labels: ${{ steps.prepare.outputs.metadata_labels }}
-          annotations: ${{ steps.prepare.outputs.metadata_annotations }}
-          cache-from: type=gha
-          # cache-to: type=gha,mode=max
-          sbom: true
-          outputs: |
-            ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' && format('type=image,"name={0}",push-by-digest=true,name-canonical=true,push=true', env.IMAGE_PATH) || format('type=image,"name={0}",push=false', env.IMAGE_PATH) }}
-            type=local,dest=/tmp/binaries
+          tags: |
+            type=semver,pattern={{version}},prefix=v
+            type=semver,pattern={{major}}.{{minor}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.0.') }},prefix=v
+            type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }},prefix=v
+            type=ref,event=branch,prefix=${{ format('refs/heads/{0}', github.event.repository.default_branch) != github.ref && 'branch-' || '' }}
+            type=ref,event=pr
+            type=sha,format=long
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+          images: ${{needs.define-variables.outputs.images}}
+          # default labels & annotations: https://github.com/docker/metadata-action/blob/master/src/meta.ts#L509
        env:
-          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
-      - name: Upload max-perf Docker artifacts
-        uses: ./.forgejo/actions/upload-docker-artifacts
-        with:
-          slug: ${{ matrix.slug }}
-          cpu_suffix: ${{ steps.prepare.outputs.cpu_suffix }}
-          artifact_suffix: "-maxperf"
-          digest_suffix: "-maxperf"
-          digest: ${{ steps.build.outputs.digest }}
+          DOCKER_METADATA_ANNOTATIONS_LEVELS: index

-  merge-maxperf:
-    name: "Create Max-Perf Manifest"
-    runs-on: dind
-    needs: build-maxperf
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-      - name: Create max-perf manifest
-        uses: ./.forgejo/actions/create-docker-manifest
-        with:
-          digest_pattern: "digests-maxperf-linux-{amd64-haswell,arm64}"
-          tag_suffix: "-maxperf"
-          images: ${{ env.IMAGE_PATH }}
-          registry_user: ${{ vars.BUILTIN_REGISTRY_USER || github.actor }}
-          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
+      - name: Create manifest list and push
+        if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+        working-directory: /tmp/digests
+        env:
+          IMAGES: ${{needs.define-variables.outputs.images}}
+        shell: bash
+        run: |
+          IFS=$'\n'
+          IMAGES_LIST=($IMAGES)
+          ANNOTATIONS_LIST=($DOCKER_METADATA_OUTPUT_ANNOTATIONS)
+          TAGS_LIST=($DOCKER_METADATA_OUTPUT_TAGS)
+          for REPO in "${IMAGES_LIST[@]}"; do
+              docker buildx imagetools create \
+                $(for tag in "${TAGS_LIST[@]}"; do echo "--tag"; echo "$tag"; done) \
+                $(for annotation in "${ANNOTATIONS_LIST[@]}"; do echo "--annotation"; echo "$annotation"; done) \
+                $(for reference in *; do printf "$REPO@sha256:%s\n" $reference; done)
+          done
+
+      - name: Inspect image
+        if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
+        env:
+          IMAGES: ${{needs.define-variables.outputs.images}}
+        shell: bash
+        run: |
+          IMAGES_LIST=($IMAGES)
+          for REPO in "${IMAGES_LIST[@]}"; do
+            docker buildx imagetools inspect $REPO:${{ steps.meta.outputs.version }}
+          done
@@ -1,7 +1,5 @@
 name: Maintenance / Renovate

-enable-email-notifications: true
-
 on:
  schedule:
    # Run at 5am UTC daily to avoid late-night dev
@@ -12,10 +10,10 @@ on:
      dryRun:
        description: 'Dry run mode'
        required: false
-        default: ''
+        default: null
        type: choice
        options:
-          - ''
+          - null
          - 'extract'
          - 'lookup'
          - 'full'
@@ -25,7 +23,6 @@ on:
        default: 'info'
        type: choice
        options:
-          - 'debug'
          - 'info'
          - 'warning'
          - 'critical'
@@ -43,11 +40,11 @@ jobs:
    name: Renovate
    runs-on: ubuntu-latest
    container:
-      image: ghcr.io/renovatebot/renovate:41.113.4@sha256:472f1a1d07a823da002be9ddf8507275517d3dc1bdcba4606ee3e62f1c27204a
+      image: ghcr.io/renovatebot/renovate:41
      options: --tmpfs /tmp:exec
    steps:
      - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
        with:
          show-progress: false

@@ -55,7 +52,7 @@ jobs:
        run: /usr/local/renovate/node -e 'console.log(`node heap limit = ${require("v8").getHeapStatistics().heap_size_limit / (1024 * 1024)} Mb`)'

      - name: Restore renovate repo cache
-        uses: actions/cache/restore@v4
+        uses: https://github.com/actions/cache@v4
        with:
          path: |
            /tmp/renovate/cache/renovate/repository
@@ -64,7 +61,7 @@ jobs:
            repo-cache-

      - name: Restore renovate package cache
-        uses: actions/cache/restore@v4
+        uses: https://github.com/actions/cache@v4
        with:
          path: |
            /tmp/renovate/cache/renovate/renovate-cache-sqlite
@@ -72,17 +69,8 @@ jobs:
          restore-keys: |
            package-cache-

-      - name: Restore renovate OSV cache
-        uses: actions/cache/restore@v4
-        with:
-          path: |
-            /tmp/osv
-          key: osv-cache-${{ github.run_id }}
-          restore-keys: |
-            osv-cache-
-
      - name: Self-hosted Renovate
-        run: renovate
+        uses: https://github.com/renovatebot/github-action@v43.0.11
        env:
          LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
          RENOVATE_DRY_RUN: ${{ inputs.dryRun || 'false' }}
@@ -96,37 +84,28 @@ jobs:

          RENOVATE_REQUIRE_CONFIG: 'required'
          RENOVATE_ONBOARDING: 'false'
-          RENOVATE_INHERIT_CONFIG: 'true'
+
+          RENOVATE_PR_COMMITS_PER_RUN_LIMIT: 3

          RENOVATE_GITHUB_TOKEN_WARN: 'false'
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
-          GITHUB_COM_TOKEN: ${{ secrets.GH_PUBLIC_RO || secrets.GH_TOKEN }}
+          GITHUB_COM_TOKEN: ${{ secrets.GH_PUBLIC_RO }}

          RENOVATE_REPOSITORY_CACHE: 'enabled'
-          RENOVATE_X_SQLITE_PACKAGE_CACHE: 'true'
-          OSV_OFFLINE_ROOT_DIR: /tmp/osv
+          RENOVATE_X_SQLITE_PACKAGE_CACHE: true

      - name: Save renovate repo cache
-        if: always()
-        uses:
-          actions/cache/save@v4
+        if: always() && env.RENOVATE_DRY_RUN != 'full'
+        uses: https://github.com/actions/cache@v4
        with:
          path: |
            /tmp/renovate/cache/renovate/repository
          key: repo-cache-${{ github.run_id }}

      - name: Save renovate package cache
-        if: always()
-        uses: actions/cache/save@v4
+        if: always() && env.RENOVATE_DRY_RUN != 'full'
+        uses: https://github.com/actions/cache@v4
        with:
          path: |
            /tmp/renovate/cache/renovate/renovate-cache-sqlite
          key: package-cache-${{ github.run_id }}
-
-      - name: Save renovate OSV cache
-        if: always()
-        uses: actions/cache/save@v4
-        with:
-          path: |
-            /tmp/osv
-          key: osv-cache-${{ github.run_id }}
@@ -13,9 +13,6 @@ extend-ignore-re = [
    "[0-9+][A-Za-z0-9+]{30,}[a-z0-9+]",
    "\\$[A-Z0-9+][A-Za-z0-9+]{6,}[a-z0-9+]",
    "\\b[a-z0-9+/=][A-Za-z0-9+/=]{7,}[a-z0-9+/=][A-Z]\\b",
-
-    # In the renovate config
-    ".ontainer"
 ]

 [default.extend-words]
@@ -45,7 +45,7 @@ version = "0.3"
 features = ["ffi", "std", "union"]

 [workspace.dependencies.const-str]
-version = "0.7.0"
+version = "0.6.2"

 [workspace.dependencies.ctor]
 version = "0.5.0"
@@ -166,8 +166,8 @@ default-features = false
 features = ["raw_value"]

 # Used for appservice registration files
-[workspace.dependencies.serde_yml]
-version = "0.0.12"
+[workspace.dependencies.serde_yaml]
+version = "0.9.34"

 # Used to load forbidden room/user regex from config
 [workspace.dependencies.serde_regex]
@@ -352,7 +352,7 @@ version = "0.1.2"
 [workspace.dependencies.ruma]
 git = "https://forgejo.ellis.link/continuwuation/ruwuma"
 #branch = "conduwuit-changes"
-rev = "78135227dceb9ce5eb9515b4ae85d452cdcabac8"
+rev = "8fb268fa2771dfc3a1c8075ef1246e7c9a0a53fd"
 features = [
    "compat",
    "rand",
@@ -387,7 +387,6 @@ features = [
    "unstable-msc4210", # remove legacy mentions
    "unstable-extensible-events",
    "unstable-pdu",
-	"unstable-msc4155"
 ]

 [workspace.dependencies.rust-rocksdb]
@@ -603,7 +602,7 @@ rev = "e4ae7628fe4fcdacef9788c4c8415317a4489941"
 # Use 1-indexed line numbers when displaying parse error messages
 [patch.crates-io.resolv-conf]
 git = "https://forgejo.ellis.link/continuwuation/resolv-conf"
-rev = "ebbbec1cb965b487a0150f5d007e96c05e3d72af"
+rev = "56251316cc4127bcbf36e68ce5e2093f4d33e227"

 #
 # Our crates
@@ -48,13 +48,11 @@ EOF

 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.15.4
+ENV BINSTALL_VERSION=1.13.0
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree
 ENV LDDTREE_VERSION=0.3.7
-# renovate: datasource=crate depName=timelord-cli
-ENV TIMELORD_VERSION=3.0.1

 # Install unpackaged tools
 RUN <<EOF
@@ -62,7 +60,6 @@ RUN <<EOF
    curl --retry 5 -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
    cargo binstall --no-confirm cargo-sbom --version $CARGO_SBOM_VERSION
    cargo binstall --no-confirm lddtree --version $LDDTREE_VERSION
-    cargo binstall --no-confirm timelord-cli --version $TIMELORD_VERSION
 EOF

 # Set up xx (cross-compilation scripts)
@@ -84,9 +81,8 @@ RUN rustc --version \
    && xx-cargo --setup-target-triple

 # Build binary
-# Configure incremental compilation based on build context
-ARG CARGO_INCREMENTAL=0
-RUN echo "CARGO_INCREMENTAL=${CARGO_INCREMENTAL}" >> /etc/environment
+# We disable incremental compilation to save disk space, as it only produces a minimal speedup for this case.
+RUN echo "CARGO_INCREMENTAL=0" >> /etc/environment

 # Configure pkg-config
 RUN <<EOF
@@ -137,11 +133,6 @@ FROM toolchain AS builder
 # Get source
 COPY . .

-# Restore timestamps from timelord cache if available
-RUN --mount=type=cache,target=/timelord/ \
-    echo "Restoring timestamps from timelord cache"; \
-    timelord sync --source-dir /app --cache-dir /timelord;
-
 ARG TARGETPLATFORM

 # Verify environment configuration
@@ -181,8 +172,8 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
        jq -r ".packages[] | select(.name == \"$PACKAGE\") | .targets[] | select( .kind | map(. == \"bin\") | any ) | .name"))
    for BINARY in "${BINARIES[@]}"; do
        echo $BINARY
-        xx-verify $TARGET_DIR/$(xx-cargo --print-target-triple)/${RUST_PROFILE}/$BINARY
-        cp $TARGET_DIR/$(xx-cargo --print-target-triple)/${RUST_PROFILE}/$BINARY /out/sbin/$BINARY
+        xx-verify $TARGET_DIR/$(xx-cargo --print-target-triple)/release/$BINARY
+        cp $TARGET_DIR/$(xx-cargo --print-target-triple)/release/$BINARY /out/sbin/$BINARY
    done
 EOF

@@ -18,7 +18,7 @@ RUN --mount=type=cache,target=/etc/apk/cache apk add \

 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.15.4
+ENV BINSTALL_VERSION=1.13.0
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree
@@ -10,11 +10,11 @@
        "nixpkgs-stable": "nixpkgs-stable"
      },
      "locked": {
-        "lastModified": 1756403898,
-        "narHash": "sha256-S4SJDmVTtbcXaJkYrMFkcA5SDrpfRHlBbzwp6IRRPAw=",
+        "lastModified": 1751403276,
+        "narHash": "sha256-V0EPQNsQko1a8OqIWc2lLviLnMpR1m08Ej00z5RVTfs=",
        "owner": "zhaofengli",
        "repo": "attic",
-        "rev": "2524dd1c007bc7a0a9e9c863a1b02de8d54b319b",
+        "rev": "896ad88fa57ad5dbcd267c0ac51f1b71ccfcb4dd",
        "type": "github"
      },
      "original": {
@@ -29,14 +29,14 @@
        "devenv": "devenv",
        "flake-compat": "flake-compat_2",
        "git-hooks": "git-hooks",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1756385612,
-        "narHash": "sha256-+NU5MMhuPHHRyvZZWNFG7zt+leRSPsJu1MwhOUzkPUk=",
+        "lastModified": 1748883665,
+        "narHash": "sha256-R0W7uAg+BLoHjMRMQ8+oiSbTq8nkGz5RDpQ+ZfxxP3A=",
        "owner": "cachix",
        "repo": "cachix",
-        "rev": "dc24688cd67518c3711d511fa369c0f5a131063a",
+        "rev": "f707778d902af4d62d8dd92c269f8e70de09acbe",
        "type": "github"
      },
      "original": {
@@ -58,21 +58,16 @@
        ],
        "git-hooks": [
          "cachix",
-          "devenv",
-          "git-hooks"
+          "devenv"
        ],
-        "nixpkgs": [
-          "cachix",
-          "devenv",
-          "nixpkgs"
-        ]
+        "nixpkgs": "nixpkgs_2"
      },
      "locked": {
-        "lastModified": 1748883665,
-        "narHash": "sha256-R0W7uAg+BLoHjMRMQ8+oiSbTq8nkGz5RDpQ+ZfxxP3A=",
+        "lastModified": 1744206633,
+        "narHash": "sha256-pb5aYkE8FOoa4n123slgHiOf1UbNSnKe5pEZC+xXD5g=",
        "owner": "cachix",
        "repo": "cachix",
-        "rev": "f707778d902af4d62d8dd92c269f8e70de09acbe",
+        "rev": "8a60090640b96f9df95d1ab99e5763a586be1404",
        "type": "github"
      },
      "original": {
@@ -83,12 +78,18 @@
      }
    },
    "crane": {
+      "inputs": {
+        "nixpkgs": [
+          "attic",
+          "nixpkgs"
+        ]
+      },
      "locked": {
-        "lastModified": 1751562746,
-        "narHash": "sha256-smpugNIkmDeicNz301Ll1bD7nFOty97T79m4GUMUczA=",
+        "lastModified": 1722960479,
+        "narHash": "sha256-NhCkJJQhD5GUib8zN9JrmYGMwt4lCRp6ZVNzIiYCl0Y=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "aed2020fd3dc26e1e857d4107a5a67a33ab6c1fd",
+        "rev": "4c6c77920b8d44cd6660c1621dea6b3fc4b4c4f4",
        "type": "github"
      },
      "original": {
@@ -99,11 +100,11 @@
    },
    "crane_2": {
      "locked": {
-        "lastModified": 1757183466,
-        "narHash": "sha256-kTdCCMuRE+/HNHES5JYsbRHmgtr+l9mOtf5dpcMppVc=",
+        "lastModified": 1750266157,
+        "narHash": "sha256-tL42YoNg9y30u7zAqtoGDNdTyXTi8EALDeCB13FtbQA=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "d599ae4847e7f87603e7082d73ca673aa93c916d",
+        "rev": "e37c943371b73ed87faf33f7583860f81f1d5a48",
        "type": "github"
      },
      "original": {
@@ -131,11 +132,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1754404745,
-        "narHash": "sha256-BdbW/iTImczgcuATgQIa9sPGuYIBxVq2xqcvICsa2AQ=",
+        "lastModified": 1748273445,
+        "narHash": "sha256-5V0dzpNgQM0CHDsMzh+ludYeu1S+Y+IMjbaskSSdFh0=",
        "owner": "cachix",
        "repo": "devenv",
-        "rev": "6563b21105168f90394dfaf58284b078af2d7275",
+        "rev": "668a50d8b7bdb19a0131f53c9f6c25c9071e1ffb",
        "type": "github"
      },
      "original": {
@@ -152,11 +153,11 @@
        "rust-analyzer-src": "rust-analyzer-src"
      },
      "locked": {
-        "lastModified": 1757400094,
-        "narHash": "sha256-5Rcs6juMoMTaMJSR1glravl4QB9yLAFBD8s7KLi4kdQ=",
+        "lastModified": 1755585599,
+        "narHash": "sha256-tl/0cnsqB/Yt7DbaGMel2RLa7QG5elA8lkaOXli6VdY=",
        "owner": "nix-community",
        "repo": "fenix",
-        "rev": "0682b9b518792c9428865c511a4c40c9ad85c243",
+        "rev": "6ed03ef4c8ec36d193c18e06b9ecddde78fb7e42",
        "type": "github"
      },
      "original": {
@@ -169,11 +170,11 @@
    "flake-compat": {
      "flake": false,
      "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
        "type": "github"
      },
      "original": {
@@ -223,11 +224,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1751413152,
-        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
+        "lastModified": 1722555600,
+        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
+        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
        "type": "github"
      },
      "original": {
@@ -246,11 +247,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "lastModified": 1712014858,
+        "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
        "type": "github"
      },
      "original": {
@@ -291,11 +292,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1750779888,
-        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
+        "lastModified": 1747372754,
+        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
+        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
        "type": "github"
      },
      "original": {
@@ -326,24 +327,31 @@
        "type": "github"
      }
    },
+    "libgit2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1697646580,
+        "narHash": "sha256-oX4Z3S9WtJlwvj0uH9HlYcWv+x1hqp8mhXl7HsLu2f0=",
+        "owner": "libgit2",
+        "repo": "libgit2",
+        "rev": "45fd9ed7ae1a9b74b957ef4f337bc3c8b3df01b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "libgit2",
+        "repo": "libgit2",
+        "type": "github"
+      }
+    },
    "nix": {
      "inputs": {
        "flake-compat": [
          "cachix",
-          "devenv",
-          "flake-compat"
+          "devenv"
        ],
        "flake-parts": "flake-parts_2",
-        "git-hooks-nix": [
-          "cachix",
-          "devenv",
-          "git-hooks"
-        ],
-        "nixpkgs": [
-          "cachix",
-          "devenv",
-          "nixpkgs"
-        ],
+        "libgit2": "libgit2",
+        "nixpkgs": "nixpkgs_3",
        "nixpkgs-23-11": [
          "cachix",
          "devenv"
@@ -351,19 +359,23 @@
        "nixpkgs-regression": [
          "cachix",
          "devenv"
+        ],
+        "pre-commit-hooks": [
+          "cachix",
+          "devenv"
        ]
      },
      "locked": {
-        "lastModified": 1752773918,
-        "narHash": "sha256-dOi/M6yNeuJlj88exI+7k154z+hAhFcuB8tZktiW7rg=",
-        "owner": "cachix",
+        "lastModified": 1745930071,
+        "narHash": "sha256-bYyjarS3qSNqxfgc89IoVz8cAFDkF9yPE63EJr+h50s=",
+        "owner": "domenkozar",
        "repo": "nix",
-        "rev": "031c3cf42d2e9391eee373507d8c12e0f9606779",
+        "rev": "b455edf3505f1bf0172b39a735caef94687d0d9c",
        "type": "github"
      },
      "original": {
-        "owner": "cachix",
-        "ref": "devenv-2.30",
+        "owner": "domenkozar",
+        "ref": "devenv-2.24",
        "repo": "nix",
        "type": "github"
      }
@@ -392,11 +404,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1737420293,
-        "narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=",
+        "lastModified": 1729742964,
+        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
        "owner": "nix-community",
        "repo": "nix-github-actions",
-        "rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9",
+        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
        "type": "github"
      },
      "original": {
@@ -407,11 +419,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1751949589,
-        "narHash": "sha256-mgFxAPLWw0Kq+C8P3dRrZrOYEQXOtKuYVlo9xvPntt8=",
+        "lastModified": 1726042813,
+        "narHash": "sha256-LnNKCCxnwgF+575y0pxUdlGZBO/ru1CtGHIqQVfvjlA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9b008d60392981ad674e04016d25619281550a9d",
+        "rev": "159be5db480d1df880a0135ca0bfed84c2f88353",
        "type": "github"
      },
      "original": {
@@ -423,27 +435,27 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1751741127,
-        "narHash": "sha256-t75Shs76NgxjZSgvvZZ9qOmz5zuBE8buUaYD28BMTxg=",
+        "lastModified": 1724316499,
+        "narHash": "sha256-Qb9MhKBUTCfWg/wqqaxt89Xfi6qTD3XpTzQ9eXi3JmE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "29e290002bfff26af1db6f64d070698019460302",
+        "rev": "797f7dc49e0bc7fab4b57c021cdf68f595e47841",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "ref": "nixos-24.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1754214453,
-        "narHash": "sha256-Q/I2xJn/j1wpkGhWkQnm20nShYnG7TI99foDBpXm1SY=",
+        "lastModified": 1733212471,
+        "narHash": "sha256-M1+uCoV5igihRfcUKrr1riygbe73/dzNnzPsmaLCmpo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "5b09dc45f24cf32316283e62aec81ffee3c3e376",
+        "rev": "55d15ad12a74eb7d4646254e13638ad0c4128776",
        "type": "github"
      },
      "original": {
@@ -455,11 +467,43 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1757034884,
-        "narHash": "sha256-PgLSZDBEWUHpfTRfFyklmiiLBE1i1aGCtz4eRA3POao=",
+        "lastModified": 1717432640,
+        "narHash": "sha256-+f9c4/ZX5MWDOuB1rKoWj+lBNm0z0rs4CK47HBLxy1o=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "ca77296380960cd497a765102eeb1356eb80fed0",
+        "rev": "88269ab3044128b7c2f4c7d68448b2fb50456870",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "release-24.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
+      "locked": {
+        "lastModified": 1748190013,
+        "narHash": "sha256-R5HJFflOfsP5FBtk+zE8FpL8uqE7n62jqOsADvVshhE=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "62b852f6c6742134ade1abdd2a21685fd617a291",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1751498133,
+        "narHash": "sha256-QWJ+NQbMU+NcU2xiyo7SNox1fAuwksGlQhpzBl76g1I=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d55716bb59b91ae9d1ced4b1ccdea7a442ecbfdb",
        "type": "github"
      },
      "original": {
@@ -478,17 +522,17 @@
        "flake-compat": "flake-compat_3",
        "flake-utils": "flake-utils",
        "nix-filter": "nix-filter",
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_5"
      }
    },
    "rust-analyzer-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1757362324,
-        "narHash": "sha256-/PAhxheUq4WBrW5i/JHzcCqK5fGWwLKdH6/Lu1tyS18=",
+        "lastModified": 1755504847,
+        "narHash": "sha256-VX0B9hwhJypCGqncVVLC+SmeMVd/GAYbJZ0MiiUn2Pk=",
        "owner": "rust-lang",
        "repo": "rust-analyzer",
-        "rev": "9edc9cbe5d8e832b5864e09854fa94861697d2fd",
+        "rev": "a905e3b21b144d77e1b304e49f3264f6f8d4db75",
        "type": "github"
      },
      "original": {
@@ -1,12 +1,28 @@
 # Continuwuity for Debian

-This document provides information about downloading and deploying the Debian package. You can also use this guide for other `apt`-based distributions such as Ubuntu.
+This document provides information about downloading and deploying the Debian package. You can also use this guide for other deb-based distributions such as Ubuntu.

 ### Installation

-See the [generic deployment guide](../deploying/generic.md) for additional information about using the Debian package.
+To add the Continuwuation apt repository:
+```bash
+# Replace with `"dev"` for bleeding-edge builds at your own risk
+export COMPONENT="stable"
+# Import the Continuwuation signing key
+sudo curl https://forgejo.ellis.link/api/packages/continuwuation/debian/repository.key -o /etc/apt/keyrings/forgejo-continuwuation.asc
+# Add a new apt source list pointing to the repository
+echo "deb [signed-by=/etc/apt/keyrings/forgejo-continuwuation.asc] https://forgejo.ellis.link/api/packages/continuwuation/debian $(lsb_release -sc) $COMPONENT" | sudo tee /etc/apt/sources.list.d/continuwuation.list
+# Update remote package lists
+sudo apt update
+```

-No `apt` repository is currently available. This feature is in development.
+To install continuwuity:
+```bash
+sudo apt install continuwuity
+```
+The `continuwuity` package conflicts with the old `conduwuit` package and will remove it automatically when installed.
+
+See the [generic deployment guide](../deploying/generic.md) for additional information about using the Debian package.

 ### Configuration

@@ -16,7 +32,7 @@ ### Configuration

 ### Running

-The package uses the [`conduwuit.service`](../configuration/examples.md#example-systemd-unit-file) systemd unit file to start and stop Continuwuity. The binary installs at `/usr/sbin/conduwuit`.
+The package uses the [`conduwuit.service`](../configuration/examples.md#example-systemd-unit-file) systemd unit file to start and stop Continuwuity. The binary installs at `/usr/bin/conduwuit`.

 By default, this package assumes that Continuwuity runs behind a reverse proxy. The default configuration options apply (listening on `localhost` and TCP port `6167`). Matrix federation requires a valid domain name and TLS. To federate properly, you must set up TLS certificates and certificate renewal.

@@ -1,12 +1,10 @@
 {
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-    "extends": ["config:recommended", "replacements:all"],
-    "osvVulnerabilityAlerts": true,
+    "extends": ["config:recommended"],
    "lockFileMaintenance": {
        "enabled": true,
        "schedule": ["at any time"]
    },
-    "platformAutomerge": true,
    "nix": {
        "enabled": true
    },
@@ -31,15 +29,10 @@
    },
    "packageRules": [
        {
-            "description": "Batch patch-level Rust dependency updates",
-            "matchManagers": ["cargo"],
-            "matchUpdateTypes": ["patch"],
-            "groupName": "rust-patch-updates"
-        },
-        {
-            "description": "Limit concurrent Cargo PRs",
-            "matchManagers": ["cargo"],
-            "prConcurrentLimit": 5
+            "description": "Batch minor and patch GitHub Actions updates",
+            "matchManagers": ["github-actions"],
+            "matchUpdateTypes": ["minor", "patch"],
+            "groupName": "github-actions-non-major"
        },
        {
            "description": "Group Rust toolchain updates into a single PR",
@@ -47,42 +40,20 @@
            "matchPackageNames": ["rust", "rustc", "cargo"],
            "groupName": "rust-toolchain"
        },
-        {
-            "description": "Batch minor and patch GitHub Actions updates",
-            "matchManagers": ["github-actions"],
-            "matchUpdateTypes": ["minor", "patch"],
-            "groupName": "github-actions-non-major"
-        },
-        {
-            "description": "Pin forgejo artifact actions to prevent breaking changes",
-            "matchManagers": ["github-actions"],
-            "matchPackageNames": ["forgejo/upload-artifact", "forgejo/download-artifact"],
-            "enabled": false
-        },
-        {
-            "description": "Auto-merge renovatebot docker image updates",
-            "matchDatasources": ["docker"],
-            "matchPackageNames": ["ghcr.io/renovatebot/renovate"],
-            "automerge": true,
-            "automergeStrategy": "fast-forward"
-        },
        {
            "description": "Group lockfile updates into a single PR",
            "matchUpdateTypes": ["lockFileMaintenance"],
            "groupName": "lockfile-maintenance"
+        },
+        {
+            "description": "Batch patch-level Rust dependency updates",
+            "matchManagers": ["cargo"],
+            "matchUpdateTypes": ["patch"],
+            "groupName": "rust-patch-updates"
+        },
+        {
+            "matchManagers": ["cargo"],
+            "prConcurrentLimit": 5
        }
-    ],
-    "customManagers": [
-       {
-         "customType": "regex",
-         "description": "Update _VERSION variables in Dockerfiles",
-         "managerFilePatterns": [
-           "/(^|/)([Dd]ocker|[Cc]ontainer)file[^/]*$/",
-           "/(^|/|\\.)([Dd]ocker|[Cc]ontainer)file$/"
-         ],
-         "matchStrings": [
-           "# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[^\\s]+?))?(?: extractVersion=(?<extractVersion>[^\\s]+?))?(?: registryUrl=(?<registryUrl>[^\\s]+?))?\\s+(?:ENV|ARG)\\s+[A-Za-z0-9_]+?_VERSION[ =][\"']?(?<currentValue>.+?)[\"']?\\s"
-         ]
-       }
    ]
 }
@@ -85,7 +85,7 @@ futures.workspace = true
 log.workspace = true
 ruma.workspace = true
 serde_json.workspace = true
-serde_yml.workspace = true
+serde_yaml.workspace = true
 tokio.workspace = true
 tracing-subscriber.workspace = true
 tracing.workspace = true
@@ -16,7 +16,7 @@ pub(super) async fn register(&self) -> Result {

 	let range = 1..checked!(body_len - 1)?;
 	let appservice_config_body = body[range].join("\n");
-	let parsed_config = serde_yml::from_str(&appservice_config_body);
+	let parsed_config = serde_yaml::from_str(&appservice_config_body);
 	match parsed_config {
 		| Err(e) => return Err!("Could not parse appservice config as YAML: {e}"),
 		| Ok(registration) => match self
@@ -57,7 +57,7 @@ pub(super) async fn show_appservice_config(&self, appservice_identifier: String)
 	{
 		| None => return Err!("Appservice does not exist."),
 		| Some(config) => {
-			let config_str = serde_yml::to_string(&config)?;
+			let config_str = serde_yaml::to_string(&config)?;
 			write!(self, "Config for {appservice_identifier}:\n\n```yaml\n{config_str}\n```")
 		},
 	}
@@ -360,7 +360,7 @@ pub(super) async fn get_remote_thumbnail(
 ) -> Result {
 	let mxc: Mxc<'_> = mxc.as_str().try_into()?;
 	let timeout = Duration::from_millis(timeout.into());
-	let dim = Dim::new(width, height, None);
+	let dim = Dim::new(width, height, None, None);
 	let mut result = self
 		.services
 		.media
@@ -405,36 +405,41 @@ pub(crate) async fn register_route(
 		)
 		.await?;

-	// Generate new device id if the user didn't specify one
-	let no_device = body.inhibit_login
+	if (!is_guest && body.inhibit_login)
 		|| body
 			.appservice_info
 			.as_ref()
-			.is_some_and(|aps| aps.registration.device_management);
-	let (token, device) = if !no_device {
-		// Don't create a device for inhibited logins
-		let device_id = if is_guest { None } else { body.device_id.clone() }
-			.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());
+			.is_some_and(|appservice| appservice.registration.device_management)
+	{
+		return Ok(register::v3::Response {
+			access_token: None,
+			user_id,
+			device_id: None,
+			refresh_token: None,
+			expires_in: None,
+		});
+	}

-		// Generate new token for the device
-		let new_token = utils::random_string(TOKEN_LENGTH);
+	// Generate new device id if the user didn't specify one
+	let device_id = if is_guest { None } else { body.device_id.clone() }
+		.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());

-		// Create device for this account
-		services
-			.users
-			.create_device(
-				&user_id,
-				&device_id,
-				&new_token,
-				body.initial_device_display_name.clone(),
-				Some(client.to_string()),
-			)
-			.await?;
-		debug_info!(%user_id, %device_id, "User account was created");
-		(Some(new_token), Some(device_id))
-	} else {
-		(None, None)
-	};
+	// Generate new token for the device
+	let token = utils::random_string(TOKEN_LENGTH);
+
+	// Create device for this account
+	services
+		.users
+		.create_device(
+			&user_id,
+			&device_id,
+			&token,
+			body.initial_device_display_name.clone(),
+			Some(client.to_string()),
+		)
+		.await?;
+
+	debug_info!(%user_id, %device_id, "User account was created");

 	let device_display_name = body.initial_device_display_name.as_deref().unwrap_or("");

@@ -578,9 +583,9 @@ pub(crate) async fn register_route(
 	}

 	Ok(register::v3::Response {
-		access_token: token,
+		access_token: Some(token),
 		user_id,
-		device_id: device,
+		device_id: Some(device_id),
 		refresh_token: None,
 		expires_in: None,
 	})
@@ -130,7 +130,7 @@ pub(crate) async fn get_context_route(
 	let state_at = events_after
 		.last()
 		.map(ref_at!(1))
-		.map_or_else(|| body.event_id.as_ref(), |pdu| pdu.event_id.as_ref());
+		.map_or(body.event_id.as_ref(), |pdu| pdu.event_id.as_ref());

 	let state_ids = services
 		.rooms
@@ -99,7 +99,7 @@ pub(crate) async fn get_content_thumbnail_route(
 ) -> Result<get_content_thumbnail::v1::Response> {
 	let user = body.sender_user();

-	let dim = Dim::from_ruma(body.width, body.height, body.method.clone())?;
+	let dim = Dim::from_ruma(body.width, body.height, body.method.clone(), body.animated)?;
 	let mxc = Mxc {
 		server_name: &body.server_name,
 		media_id: &body.media_id,
@@ -322,7 +322,7 @@ pub(crate) async fn get_content_thumbnail_legacy_route(
 		media_id: &body.media_id,
 	};

-	let dim = Dim::from_ruma(body.width, body.height, body.method.clone())?;
+	let dim = Dim::from_ruma(body.width, body.height, body.method.clone(), body.animated)?;
 	match services.media.get_thumbnail(&mxc, &dim).await? {
 		| Some(FileMeta {
 			content,
@@ -1,3 +1,5 @@
+use std::collections::BTreeMap;
+
 use axum::extract::State;
 use conduwuit::{
 	Err, Result,
@@ -224,8 +226,7 @@ pub(crate) async fn get_avatar_url_route(

 /// # `GET /_matrix/client/v3/profile/{userId}`
 ///
-/// Returns the displayname, avatar_url, blurhash, and custom profile fields of
-/// the user.
+/// Returns the displayname, avatar_url, blurhash, and tz of the user.
 ///
 /// - If user is on another server and we do not have a local copy already,
 ///   fetch profile over federation.
@@ -259,6 +260,9 @@ pub(crate) async fn get_profile_route(
 			services
 				.users
 				.set_blurhash(&body.user_id, response.blurhash.clone());
+			services
+				.users
+				.set_timezone(&body.user_id, response.tz.clone());

 			for (profile_key, profile_key_value) in &response.custom_profile_fields {
 				services.users.set_profile_key(
@@ -272,6 +276,7 @@ pub(crate) async fn get_profile_route(
 				displayname: response.displayname,
 				avatar_url: response.avatar_url,
 				blurhash: response.blurhash,
+				tz: response.tz,
 				custom_profile_fields: response.custom_profile_fields,
 			});
 		}
@@ -283,11 +288,21 @@ pub(crate) async fn get_profile_route(
 		return Err!(Request(NotFound("Profile was not found.")));
 	}

-	let (avatar_url, blurhash, displayname, custom_profile_fields) = join4(
+	let mut custom_profile_fields: BTreeMap<String, serde_json::Value> = services
+		.users
+		.all_profile_keys(&body.user_id)
+		.collect()
+		.await;
+
+	// services.users.timezone will collect the MSC4175 timezone key if it exists
+	custom_profile_fields.remove("us.cloke.msc4175.tz");
+	custom_profile_fields.remove("m.tz");
+
+	let (avatar_url, blurhash, displayname, tz) = join4(
 		services.users.avatar_url(&body.user_id).ok(),
 		services.users.blurhash(&body.user_id).ok(),
 		services.users.displayname(&body.user_id).ok(),
-		services.users.all_profile_keys(&body.user_id).collect(),
+		services.users.timezone(&body.user_id).ok(),
 	)
 	.await;

@@ -295,6 +310,7 @@ pub(crate) async fn get_profile_route(
 		avatar_url,
 		blurhash,
 		displayname,
+		tz,
 		custom_profile_fields,
 	})
 }
@@ -1,4 +1,4 @@
-use std::{fmt::Write as _, time::Duration};
+use std::{fmt::Write as _, ops::Mul, time::Duration};

 use axum::extract::State;
 use axum_client_ip::InsecureClientIp;
@@ -12,6 +12,7 @@
 		room::{report_content, report_room},
 	},
 	events::{Mentions, room::message::RoomMessageEventContent},
+	int,
 };
 use tokio::time::sleep;

@@ -24,6 +25,7 @@ struct Report {
 	user_id: Option<OwnedUserId>,
 	report_type: String,
 	reason: Option<String>,
+	score: Option<ruma::Int>,
 }

 /// # `POST /_matrix/client/v3/rooms/{roomId}/report`
@@ -48,15 +50,6 @@ pub(crate) async fn report_room_route(

 	delay_response().await;

-	// We log this early in case the room ID does actually exist, in which case
-	// admins who scan their logs can see the report and choose to investigate at
-	// their discretion.
-	info!(
-		"Received room report by user {sender_user} for room {} with reason: \"{}\"",
-		body.room_id,
-		body.reason.as_deref().unwrap_or("")
-	);
-
 	if !services
 		.rooms
 		.state_cache
@@ -67,6 +60,11 @@ pub(crate) async fn report_room_route(
 			"Room does not exist to us, no local users have joined at all"
 		)));
 	}
+	info!(
+		"Received room report by user {sender_user} for room {} with reason: \"{}\"",
+		body.room_id,
+		body.reason.as_deref().unwrap_or("")
+	);

 	let report = Report {
 		sender: sender_user.to_owned(),
@@ -75,6 +73,7 @@ pub(crate) async fn report_room_route(
 		user_id: None,
 		report_type: "room".to_owned(),
 		reason: body.reason.clone(),
+		score: None,
 	};

 	services.admin.send_message(build_report(report)).await.ok();
@@ -110,6 +109,7 @@ pub(crate) async fn report_event_route(
 		&body.room_id,
 		sender_user,
 		body.reason.as_ref(),
+		body.score,
 		&pdu,
 	)
 	.await?;
@@ -127,6 +127,7 @@ pub(crate) async fn report_event_route(
 		user_id: None,
 		report_type: "event".to_owned(),
 		reason: body.reason.clone(),
+		score: body.score,
 	};
 	services.admin.send_message(build_report(report)).await.ok();

@@ -165,6 +166,7 @@ pub(crate) async fn report_user_route(
 		user_id: Some(body.user_id.clone()),
 		report_type: "user".to_owned(),
 		reason: body.reason.clone(),
+		score: None,
 	};

 	info!(
@@ -190,6 +192,7 @@ async fn is_event_report_valid(
 	room_id: &RoomId,
 	sender_user: &UserId,
 	reason: Option<&String>,
+	score: Option<ruma::Int>,
 	pdu: &PduEvent,
 ) -> Result<()> {
 	debug_info!(
@@ -201,6 +204,10 @@ async fn is_event_report_valid(
 		return Err!(Request(NotFound("Event ID does not belong to the reported room",)));
 	}

+	if score.is_some_and(|s| s > int!(0) || s < int!(-100)) {
+		return Err!(Request(InvalidParam("Invalid score, must be within 0 to -100",)));
+	}
+
 	if reason.as_ref().is_some_and(|s| s.len() > 750) {
 		return Err!(Request(
 			InvalidParam("Reason too long, should be 750 characters or fewer",)
@@ -233,6 +240,9 @@ fn build_report(report: Report) -> RoomMessageEventContent {
 	if report.event_id.is_some() {
 		let _ = writeln!(text, "- Reported Event ID: `{}`", report.event_id.unwrap());
 	}
+	if let Some(score) = report.score {
+		let _ = writeln!(text, "- User-supplied offensiveness score: {}%", score.mul(int!(-1)));
+	}
 	if let Some(reason) = report.reason {
 		let _ = writeln!(text, "- Report Reason: {reason}");
 	}
@@ -2,14 +2,18 @@

 use axum::extract::State;
 use axum_client_ip::InsecureClientIp;
-use conduwuit::{Err, Result};
+use conduwuit::{Err, Error, Result};
 use futures::StreamExt;
 use ruma::{
 	OwnedRoomId,
 	api::{
 		client::{
+			error::ErrorKind,
 			membership::mutual_rooms,
-			profile::{delete_profile_key, get_profile_key, set_profile_key},
+			profile::{
+				delete_profile_key, delete_timezone_key, get_profile_key, get_timezone_key,
+				set_profile_key, set_timezone_key,
+			},
 		},
 		federation,
 	},
@@ -56,6 +60,62 @@ pub(crate) async fn get_mutual_rooms_route(
 	})
 }

+/// # `DELETE /_matrix/client/unstable/uk.tcpip.msc4133/profile/:user_id/us.cloke.msc4175.tz`
+///
+/// Deletes the `tz` (timezone) of a user, as per MSC4133 and MSC4175.
+///
+/// - Also makes sure other users receive the update using presence EDUs
+pub(crate) async fn delete_timezone_key_route(
+	State(services): State<crate::State>,
+	body: Ruma<delete_timezone_key::unstable::Request>,
+) -> Result<delete_timezone_key::unstable::Response> {
+	let sender_user = body.sender_user();
+
+	if *sender_user != body.user_id && body.appservice_info.is_none() {
+		return Err!(Request(Forbidden("You cannot update the profile of another user")));
+	}
+
+	services.users.set_timezone(&body.user_id, None);
+
+	if services.config.allow_local_presence {
+		// Presence update
+		services
+			.presence
+			.ping_presence(&body.user_id, &PresenceState::Online)
+			.await?;
+	}
+
+	Ok(delete_timezone_key::unstable::Response {})
+}
+
+/// # `PUT /_matrix/client/unstable/uk.tcpip.msc4133/profile/:user_id/us.cloke.msc4175.tz`
+///
+/// Updates the `tz` (timezone) of a user, as per MSC4133 and MSC4175.
+///
+/// - Also makes sure other users receive the update using presence EDUs
+pub(crate) async fn set_timezone_key_route(
+	State(services): State<crate::State>,
+	body: Ruma<set_timezone_key::unstable::Request>,
+) -> Result<set_timezone_key::unstable::Response> {
+	let sender_user = body.sender_user();
+
+	if *sender_user != body.user_id && body.appservice_info.is_none() {
+		return Err!(Request(Forbidden("You cannot update the profile of another user")));
+	}
+
+	services.users.set_timezone(&body.user_id, body.tz.clone());
+
+	if services.config.allow_local_presence {
+		// Presence update
+		services
+			.presence
+			.ping_presence(&body.user_id, &PresenceState::Online)
+			.await?;
+	}
+
+	Ok(set_timezone_key::unstable::Response {})
+}
+
 /// # `PUT /_matrix/client/unstable/uk.tcpip.msc4133/profile/{user_id}/{field}`
 ///
 /// Updates the profile key-value field of a user, as per MSC4133.
@@ -90,14 +150,19 @@ pub(crate) async fn set_profile_key_route(
 		)));
 	};

+	if body
+		.kv_pair
+		.keys()
+		.any(|key| key.starts_with("u.") && !profile_key_value.is_string())
+	{
+		return Err!(Request(BadJson("u.* profile key fields must be strings")));
+	}
+
 	if body.kv_pair.keys().any(|key| key.len() > 128) {
 		return Err!(Request(BadJson("Key names cannot be longer than 128 bytes")));
 	}

 	if body.key_name == "displayname" {
-		let Some(display_name) = profile_key_value.as_str() else {
-			return Err!(Request(BadJson("displayname must be a string")));
-		};
 		let all_joined_rooms: Vec<OwnedRoomId> = services
 			.rooms
 			.state_cache
@@ -109,15 +174,12 @@ pub(crate) async fn set_profile_key_route(
 		update_displayname(
 			&services,
 			&body.user_id,
-			Some(display_name.to_owned()),
+			Some(profile_key_value.to_string()),
 			&all_joined_rooms,
 		)
 		.await;
 	} else if body.key_name == "avatar_url" {
-		let Some(avatar_url) = profile_key_value.as_str() else {
-			return Err!(Request(BadJson("avatar_url must be a string")));
-		};
-		let mxc = ruma::OwnedMxcUri::from(avatar_url);
+		let mxc = ruma::OwnedMxcUri::from(profile_key_value.to_string());

 		let all_joined_rooms: Vec<OwnedRoomId> = services
 			.rooms
@@ -206,12 +268,70 @@ pub(crate) async fn delete_profile_key_route(
 	Ok(delete_profile_key::unstable::Response {})
 }

+/// # `GET /_matrix/client/unstable/uk.tcpip.msc4133/profile/:user_id/us.cloke.msc4175.tz`
+///
+/// Returns the `timezone` of the user as per MSC4133 and MSC4175.
+///
+/// - If user is on another server and we do not have a local copy already fetch
+///   `timezone` over federation
+pub(crate) async fn get_timezone_key_route(
+	State(services): State<crate::State>,
+	body: Ruma<get_timezone_key::unstable::Request>,
+) -> Result<get_timezone_key::unstable::Response> {
+	if !services.globals.user_is_local(&body.user_id) {
+		// Create and update our local copy of the user
+		if let Ok(response) = services
+			.sending
+			.send_federation_request(
+				body.user_id.server_name(),
+				federation::query::get_profile_information::v1::Request {
+					user_id: body.user_id.clone(),
+					field: None, // we want the full user's profile to update locally as well
+				},
+			)
+			.await
+		{
+			if !services.users.exists(&body.user_id).await {
+				services.users.create(&body.user_id, None, None).await?;
+			}
+
+			services
+				.users
+				.set_displayname(&body.user_id, response.displayname.clone());
+
+			services
+				.users
+				.set_avatar_url(&body.user_id, response.avatar_url.clone());
+
+			services
+				.users
+				.set_blurhash(&body.user_id, response.blurhash.clone());
+
+			services
+				.users
+				.set_timezone(&body.user_id, response.tz.clone());
+
+			return Ok(get_timezone_key::unstable::Response { tz: response.tz });
+		}
+	}
+
+	if !services.users.exists(&body.user_id).await {
+		// Return 404 if this user doesn't exist and we couldn't fetch it over
+		// federation
+		return Err(Error::BadRequest(ErrorKind::NotFound, "Profile was not found."));
+	}
+
+	Ok(get_timezone_key::unstable::Response {
+		tz: services.users.timezone(&body.user_id).await.ok(),
+	})
+}
+
 /// # `GET /_matrix/client/unstable/uk.tcpip.msc4133/profile/{userId}/{field}}`
 ///
 /// Gets the profile key-value field of a user, as per MSC4133.
 ///
 /// - If user is on another server and we do not have a local copy already fetch
-///   the value over federation
+///   `timezone` over federation
 pub(crate) async fn get_profile_key_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_profile_key::unstable::Request>,
@@ -247,6 +367,10 @@ pub(crate) async fn get_profile_key_route(
 				.users
 				.set_blurhash(&body.user_id, response.blurhash.clone());

+			services
+				.users
+				.set_timezone(&body.user_id, response.tz.clone());
+
 			match response.custom_profile_fields.get(&body.key_name) {
 				| Some(value) => {
 					profile_key_value.insert(body.key_name.clone(), value.clone());
@@ -22,9 +22,12 @@
 pub fn build(router: Router<State>, server: &Server) -> Router<State> {
 	let config = &server.config;
 	let mut router = router
+        .ruma_route(&client::get_timezone_key_route)
        .ruma_route(&client::get_profile_key_route)
        .ruma_route(&client::set_profile_key_route)
        .ruma_route(&client::delete_profile_key_route)
+        .ruma_route(&client::set_timezone_key_route)
+        .ruma_route(&client::delete_timezone_key_route)
        .ruma_route(&client::appservice_ping)
 		.ruma_route(&client::get_supported_versions_route)
 		.ruma_route(&client::get_register_available_route)
@@ -20,7 +20,9 @@
 		client::{
 			directory::get_public_rooms,
 			error::ErrorKind,
-			profile::{get_avatar_url, get_display_name, get_profile, get_profile_key},
+			profile::{
+				get_avatar_url, get_display_name, get_profile, get_profile_key, get_timezone_key,
+			},
 			voip::get_turn_server_info,
 		},
 		federation::{authentication::XMatrix, openid::get_openid_userinfo},
@@ -87,7 +89,8 @@ pub(super) async fn auth(
 			| &get_profile::v3::Request::METADATA
 			| &get_profile_key::unstable::Request::METADATA
 			| &get_display_name::v3::Request::METADATA
-			| &get_avatar_url::v3::Request::METADATA => {
+			| &get_avatar_url::v3::Request::METADATA
+			| &get_timezone_key::unstable::Request::METADATA => {
 				if services.server.config.require_auth_for_profile_requests {
 					match token {
 						| Token::Appservice(_) | Token::User(_) => {
@@ -67,7 +67,7 @@ pub(crate) async fn get_content_thumbnail_route(
 	InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<get_content_thumbnail::v1::Request>,
 ) -> Result<get_content_thumbnail::v1::Response> {
-	let dim = Dim::from_ruma(body.width, body.height, body.method.clone())?;
+	let dim = Dim::from_ruma(body.width, body.height, body.method.clone(), body.animated)?;
 	let mxc = Mxc {
 		server_name: services.globals.server_name(),
 		media_id: &body.media_id,
@@ -83,6 +83,7 @@ pub(crate) async fn get_profile_information_route(
 	let mut displayname = None;
 	let mut avatar_url = None;
 	let mut blurhash = None;
+	let mut tz = None;
 	let mut custom_profile_fields = BTreeMap::new();

 	match &body.field {
@@ -106,6 +107,7 @@ pub(crate) async fn get_profile_information_route(
 			displayname = services.users.displayname(&body.user_id).await.ok();
 			avatar_url = services.users.avatar_url(&body.user_id).await.ok();
 			blurhash = services.users.blurhash(&body.user_id).await.ok();
+			tz = services.users.timezone(&body.user_id).await.ok();
 			custom_profile_fields = services
 				.users
 				.all_profile_keys(&body.user_id)
@@ -114,10 +116,15 @@ pub(crate) async fn get_profile_information_route(
 		},
 	}

+	// services.users.timezone will collect the MSC4175 timezone key if it exists
+	custom_profile_fields.remove("us.cloke.msc4175.tz");
+	custom_profile_fields.remove("m.tz");
+
 	Ok(get_profile_information::v1::Response {
 		displayname,
 		avatar_url,
 		blurhash,
+		tz,
 		custom_profile_fields,
 	})
 }
@@ -92,7 +92,7 @@ ruma.workspace = true
 sanitize-filename.workspace = true
 serde_json.workspace = true
 serde_regex.workspace = true
-serde_yml.workspace = true
+serde_yaml.workspace = true
 serde.workspace = true
 smallvec.workspace = true
 smallstr.workspace = true
@@ -83,7 +83,7 @@ pub enum Error {
 	#[error(transparent)]
 	TypedHeader(#[from] axum_extra::typed_header::TypedHeaderRejection),
 	#[error(transparent)]
-	Yaml(#[from] serde_yml::Error),
+	Yaml(#[from] serde_yaml::Error),

 	// ruma/conduwuit
 	#[error("Arithmetic operation failed: {0}")]
@@ -27,5 +27,5 @@ fn init_user_agent() -> String { format!("{}/{}", name(), version()) }

 fn init_version() -> String {
 	conduwuit_build_metadata::version_tag()
-		.map_or_else(|| SEMANTIC.to_owned(), |extra| format!("{SEMANTIC} ({extra})"))
+		.map_or(SEMANTIC.to_owned(), |extra| format!("{SEMANTIC} ({extra})"))
 }
@@ -585,11 +585,10 @@ struct GetThirdPartyInvite {
 		(target_membership == MembershipState::Join).then_some(&power_levels.users_default)
 	});

-	let join_rules = if let Some(jr) = &join_rules_event {
-		from_json_str::<RoomJoinRulesEventContent>(jr.content().get())?.join_rule
-	} else {
-		JoinRule::Invite
-	};
+	let mut join_rules = JoinRule::Invite;
+	if let Some(jr) = &join_rules_event {
+		join_rules = from_json_str::<RoomJoinRulesEventContent>(jr.content().get())?.join_rule;
+	}

 	let power_levels_event_id = power_levels_event.as_ref().map(Event::event_id);
 	let sender_membership_event_id = sender_membership_event.as_ref().map(Event::event_id);
@@ -65,7 +65,7 @@ fn expect_false(self, msg: &str) -> Self { (!self).then_some(false).expect(msg)
 	fn into_option(self) -> Option<()> { self.then_some(()) }

 	#[inline]
-	fn into_result(self) -> Result<(), ()> { BoolExt::ok_or(self, ()) }
+	fn into_result(self) -> Result<(), ()> { self.ok_or(()) }

 	#[inline]
 	fn map<T, F: FnOnce(Self) -> T>(self, f: F) -> T
@@ -77,7 +77,7 @@ fn map<T, F: FnOnce(Self) -> T>(self, f: F) -> T

 	#[inline]
 	fn map_ok_or<T, E, F: FnOnce() -> T>(self, err: E, f: F) -> Result<T, E> {
-		BoolExt::ok_or(self, err).map(|()| f())
+		self.ok_or(err).map(|()| f())
 	}

 	#[inline]
@@ -22,11 +22,13 @@ crate-type = [
 ]

 [package.metadata.deb]
-name = "conduwuit"
-maintainer = "strawberry <strawberry@puppygock.gay>"
-copyright = "2024, strawberry <strawberry@puppygock.gay>"
+name = "continuwuity"
+maintainer = "continuwuity developers <contact@continuwuity.org>"
+copyright = "2024, continuwuity developers"
 license-file = ["../../LICENSE", "3"]
 depends = "$auto, ca-certificates"
+breaks = ["conduwuit (<<0.5.0)"]
+replaces = ["conduwuit (<<0.5.0)"]
 extended-description = """\
 a cool hard fork of Conduit, a Matrix homeserver written in Rust"""
 section = "net"
@@ -105,7 +105,7 @@ rustyline-async.workspace = true
 rustyline-async.optional = true
 serde_json.workspace = true
 serde.workspace = true
-serde_yml.workspace = true
+serde_yaml.workspace = true
 sha2.workspace = true
 termimad.workspace = true
 termimad.optional = true
@@ -271,7 +271,7 @@ pub async fn get_db_registration(&self, id: &str) -> Result<Registration> {
 			.id_appserviceregistrations
 			.get(id)
 			.await
-			.and_then(|ref bytes| serde_yml::from_slice(bytes).map_err(Into::into))
+			.and_then(|ref bytes| serde_yaml::from_slice(bytes).map_err(Into::into))
 			.map_err(|e| err!(Database("Invalid appservice {id:?} registration: {e:?}")))
 	}

@@ -29,19 +29,20 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 		let db = Data::new(&args);
 		let config = &args.server.config;

-		let turn_secret = config.turn_secret_file.as_ref().map_or_else(
-			|| config.turn_secret.clone(),
-			|path| {
-				std::fs::read_to_string(path).unwrap_or_else(|e| {
-					error!("Failed to read the TURN secret file: {e}");
+		let turn_secret =
+			config
+				.turn_secret_file
+				.as_ref()
+				.map_or(config.turn_secret.clone(), |path| {
+					std::fs::read_to_string(path).unwrap_or_else(|e| {
+						error!("Failed to read the TURN secret file: {e}");

-					config.turn_secret.clone()
-				})
-			},
-		);
+						config.turn_secret.clone()
+					})
+				});

-		let registration_token = config.registration_token_file.as_ref().map_or_else(
-			|| config.registration_token.clone(),
+		let registration_token = config.registration_token_file.as_ref().map_or(
+			config.registration_token.clone(),
 			|path| {
 				let Ok(token) = std::fs::read_to_string(path).inspect_err(|e| {
 					error!("Failed to read the registration token file: {e}");
@@ -372,7 +372,7 @@ pub async fn fetch_remote_thumbnail_legacy(
 		})
 		.await?;

-	let dim = Dim::from_ruma(body.width, body.height, body.method.clone())?;
+	let dim = Dim::from_ruma(body.width, body.height, body.method.clone(), body.animated)?;
 	self.upload_thumbnail(
 		&mxc,
 		None,
@@ -16,12 +16,13 @@

 use super::{FileMeta, data::Metadata};

-/// Dimension specification for a thumbnail.
+/// Dimension and format specification for a thumbnail.
 #[derive(Debug)]
 pub struct Dim {
 	pub width: u32,
 	pub height: u32,
 	pub method: Method,
+	pub animated: bool,
 }

 impl super::Service {
@@ -179,8 +180,14 @@ fn into_filemeta(data: Metadata, content: Vec<u8>) -> FileMeta {
 }

 impl Dim {
-	/// Instantiate a Dim from Ruma integers with optional method.
-	pub fn from_ruma(width: UInt, height: UInt, method: Option<Method>) -> Result<Self> {
+	/// Instantiate a Dim from Ruma integers with optional method and animation
+	/// flag.
+	pub fn from_ruma(
+		width: UInt,
+		height: UInt,
+		method: Option<Method>,
+		animated: Option<bool>,
+	) -> Result<Self> {
 		let width = width
 			.try_into()
 			.map_err(|e| err!(Request(InvalidParam("Width is invalid: {e:?}"))))?;
@@ -188,17 +195,19 @@ pub fn from_ruma(width: UInt, height: UInt, method: Option<Method>) -> Result<Se
 			.try_into()
 			.map_err(|e| err!(Request(InvalidParam("Height is invalid: {e:?}"))))?;

-		Ok(Self::new(width, height, method))
+		Ok(Self::new(width, height, method, animated))
 	}

-	/// Instantiate a Dim with optional method
+	/// Instantiate a Dim with optional method and animation flag.
 	#[inline]
 	#[must_use]
-	pub fn new(width: u32, height: u32, method: Option<Method>) -> Self {
+	pub fn new(width: u32, height: u32, method: Option<Method>, animated: Option<bool>) -> Self {
 		Self {
 			width,
 			height,
 			method: method.unwrap_or(Method::Scale),
+			// "When not provided, the server SHOULD NOT return an animated thumbnail"
+			animated: animated.unwrap_or(false),
 		}
 	}

@@ -229,6 +238,7 @@ pub fn scaled(&self, image: &Self) -> Result<Self> {
 			width: x,
 			height: y,
 			method: Method::Scale,
+			animated: self.animated,
 		})
 	}

@@ -238,11 +248,11 @@ pub fn scaled(&self, image: &Self) -> Result<Self> {
 	#[must_use]
 	pub fn normalized(&self) -> Self {
 		match (self.width, self.height) {
-			| (0..=32, 0..=32) => Self::new(32, 32, Some(Method::Crop)),
-			| (0..=96, 0..=96) => Self::new(96, 96, Some(Method::Crop)),
-			| (0..=320, 0..=240) => Self::new(320, 240, Some(Method::Scale)),
-			| (0..=640, 0..=480) => Self::new(640, 480, Some(Method::Scale)),
-			| (0..=800, 0..=600) => Self::new(800, 600, Some(Method::Scale)),
+			| (0..=32, 0..=32) => Self::new(32, 32, Some(Method::Crop), Some(self.animated)),
+			| (0..=96, 0..=96) => Self::new(96, 96, Some(Method::Crop), Some(self.animated)),
+			| (0..=320, 0..=240) => Self::new(320, 240, Some(Method::Scale), Some(self.animated)),
+			| (0..=640, 0..=480) => Self::new(640, 480, Some(Method::Scale), Some(self.animated)),
+			| (0..=800, 0..=600) => Self::new(800, 600, Some(Method::Scale), Some(self.animated)),
 			| _ => Self::default(),
 		}
 	}
@@ -260,6 +270,7 @@ fn default() -> Self {
 			width: 0,
 			height: 0,
 			method: Method::Scale,
+			animated: false,
 		}
 	}
 }
@@ -439,7 +439,13 @@ async fn send_notice<E>(
 					notifi.counts = NotificationCounts::default();
 				}

-				if !event_id_only {
+				if event_id_only {
+					self.send_request(
+						&http.url,
+						send_event_notification::v1::Request::new(notifi),
+					)
+					.await?;
+				} else {
 					if *event.kind() == TimelineEventType::RoomEncrypted
 						|| tweaks
 							.iter()
@@ -474,10 +480,13 @@ async fn send_notice<E>(
 						.get_canonical_alias(event.room_id())
 						.await
 						.ok();
-				}

-				self.send_request(&http.url, send_event_notification::v1::Request::new(notifi))
+					self.send_request(
+						&http.url,
+						send_event_notification::v1::Request::new(notifi),
+					)
 					.await?;
+				}

 				Ok(())
 			},
@@ -1102,34 +1102,6 @@ pub async fn find_from_login_token(&self, token: &str) -> Result<OwnedUserId> {
 		Ok(user_id)
 	}

-	#[inline]
-	fn parse_profile_kv(
-		&self,
-		user_id: &UserId,
-		key: &str,
-		value: Vec<u8>,
-	) -> Result<serde_json::Value> {
-		match serde_json::from_slice(&value) {
-			| Ok(value) => Ok(value),
-			| Err(error) => {
-				// Due to an old bug, some conduwuit databases have `us.cloke.msc4175.tz` user
-				// profile fields with raw strings instead of quoted JSON ones.
-				if key == "us.cloke.msc4175.tz" {
-					// TODO insert a hint about this being a cold path
-					debug_warn!(
-						"Fixing corrupt `us.cloke.msc4175.tz` field in the profile of {}",
-						user_id
-					);
-					let raw_tz = serde_json::Value::String(String::from_utf8(value)?);
-					self.set_profile_key(user_id, "us.cloke.msc4175.tz", Some(raw_tz.clone()));
-					Ok(raw_tz)
-				} else {
-					Err(error.into())
-				}
-			},
-		}
-	}
-
 	/// Gets a specific user profile key
 	pub async fn profile_key(
 		&self,
@@ -1141,7 +1113,7 @@ pub async fn profile_key(
 			.useridprofilekey_value
 			.qry(&key)
 			.await
-			.and_then(|handle| self.parse_profile_kv(user_id, profile_key, handle.to_vec()))
+			.deserialized()
 	}

 	/// Gets all the user's profile keys and values in an iterator
@@ -1149,18 +1121,14 @@ pub fn all_profile_keys<'a>(
 		&'a self,
 		user_id: &'a UserId,
 	) -> impl Stream<Item = (String, serde_json::Value)> + 'a + Send {
-		type KeyVal<'a> = ((Ignore, String), &'a [u8]);
+		type KeyVal = ((Ignore, String), serde_json::Value);

 		let prefix = (user_id, Interfix);
 		self.db
 			.useridprofilekey_value
 			.stream_prefix(&prefix)
 			.ignore_err()
-			.map(|((_, key), value): KeyVal<'_>| {
-				let value = self.parse_profile_kv(user_id, &key, value.to_vec())?;
-				Ok((key, value))
-			})
-			.ignore_err()
+			.map(|((_, key), val): KeyVal| (key, val))
 	}

 	/// Sets a new profile key value, removes the key if value is None
@@ -1180,6 +1148,34 @@ pub fn set_profile_key(
 		}
 	}

+	/// Get the timezone of a user.
+	pub async fn timezone(&self, user_id: &UserId) -> Result<String> {
+		// TODO: transparently migrate unstable key usage to the stable key once MSC4133
+		// and MSC4175 are stable, likely a remove/insert in this block.
+
+		// first check the unstable prefix then check the stable prefix
+		let unstable_key = (user_id, "us.cloke.msc4175.tz");
+		let stable_key = (user_id, "m.tz");
+		self.db
+			.useridprofilekey_value
+			.qry(&unstable_key)
+			.or_else(|_| self.db.useridprofilekey_value.qry(&stable_key))
+			.await
+			.deserialized()
+	}
+
+	/// Sets a new timezone or removes it if timezone is None.
+	pub fn set_timezone(&self, user_id: &UserId, timezone: Option<String>) {
+		// TODO: insert to the stable MSC4175 key when it's stable
+		let key = (user_id, "us.cloke.msc4175.tz");
+
+		if let Some(timezone) = timezone {
+			self.db.useridprofilekey_value.put_raw(key, &timezone);
+		} else {
+			self.db.useridprofilekey_value.del(key);
+		}
+	}
+
 	#[cfg(not(feature = "ldap"))]
 	pub async fn search_ldap(&self, _user_id: &UserId) -> Result<Vec<(String, bool)>> {
 		Err!(FeatureDisabled("ldap"))
Author	SHA1	Message	Date
Ginger	83b94cc375	feat: Add animated flag to Dim	2025-09-10 10:49:20 -04:00
Ginger	aab4c5eaee	fix: Use apt-get and dpkg instead of apt (which isn't stable in scripts)	2025-09-10 10:12:57 -04:00
Ginger	660f1ee790	fix: Change cargo-deb steps to play nice with the setup-rust action	2025-09-10 09:41:13 -04:00
Ginger	d8f6c0fc67	fix: More logging	2025-09-10 09:20:01 -04:00
Ginger	01dd4575b7	fix: Insert whereis call	2025-09-10 09:13:31 -04:00
Ginger	7f2cd69bd9	fix: More ls calls	2025-09-10 09:03:36 -04:00
Ginger	6ed175f75d	fix: Add debugging ls. what is the problem here	2025-09-10 09:00:34 -04:00
ginger	3723233605	fix: Fix cargo-deb cache keys	2025-09-09 20:13:24 +00:00
Ginger	f169d68ba7	docs: Add a note about the dev component	2025-09-09 09:21:16 -04:00
Ginger	6805f16d9c	fix: Name artifacts for their distro	2025-09-09 09:16:00 -04:00
Ginger	25732963c2	feat: Build for both Debian and Ubuntu, take 2	2025-09-09 08:52:54 -04:00
Ginger	8b6ffc3700	Revert "feat: Build for both Debian and Ubuntu" This reverts commit `5cd0704e14`.	2025-09-08 14:03:33 -04:00
Ginger	5cd0704e14	feat: Build for both Debian and Ubuntu	2025-09-08 13:44:47 -04:00
Ginger	3509c5a65a	fix: No slashes in components I guess	2025-09-08 13:33:56 -04:00
Ginger	6c800a293c	fix: Fix incorrect quoting, again	2025-09-08 13:18:36 -04:00
Ginger	696e29d087	fix: Fix incorrect quoting	2025-09-08 13:16:37 -04:00
Ginger	863239f341	fix: Minor component and version format fixes	2025-09-08 13:13:47 -04:00
Ginger	e7a79b1e03	docs: Update Debian installation guide	2025-09-08 13:11:04 -04:00
Ginger	4af08c2b07	fix: Rename `debian_version` for consistency	2025-09-08 13:01:40 -04:00
Ginger	980b39c946	fix: Munge version names better	2025-09-08 12:42:24 -04:00
Ginger	67810682cd	fix: Install build dependencies _before_ running the build 💀	2025-09-08 12:34:17 -04:00
Ginger	53a7e815da	fix: Use month instead of minute in package timestamps	2025-09-08 12:31:09 -04:00
Ginger	d3c88c6242	fix: Fix step order	2025-09-08 12:25:21 -04:00
Ginger	30df03524f	fix: Cache cargo-deb, use better versioning scheme	2025-09-08 12:24:30 -04:00
Ginger	fa4e0b8802	fix: Mark continuwuity as replacing conduwuit	2025-09-08 11:51:38 -04:00
Ginger	a3422d5625	fix: Fix typo	2025-09-08 11:29:17 -04:00
Ginger	f5003206fa	fix: More debug logging	2025-09-08 11:27:38 -04:00
Ginger	dbd5d347ec	feat: Publish the deb to Forgejo's registry	2025-09-08 11:23:35 -04:00
Ginger	a873329a42	fix: Fix ambiguous redirect	2025-09-08 10:27:58 -04:00
Ginger	d14310a1e5	fix: Run apt-get update first	2025-09-08 10:23:35 -04:00
Ginger	52fb7b5ede	fix: Use binstall for cargo-deb	2025-09-08 10:21:35 -04:00
Ginger	ede03e30a7	fix: Remove duplicate checkout step	2025-09-08 10:20:33 -04:00
Ginger	452afb7829	fix: Use Ubuntu runners for now	2025-09-08 10:19:32 -04:00
Ginger	5a2288fe06	fix: Remove copied Fedora-specific workflow step	2025-09-08 09:49:29 -04:00
Ginger	3fc03c9cd7	feat(ci): Initial debian build workflow	2025-09-08 09:46:55 -04:00
Ginger	fd501fc290	fix: Update debian package metadata	2025-09-08 09:46:12 -04:00