From 9c5ab7e311a7722d5ea5187e02f1d044ae52a257 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 13 Feb 2026 13:18:34 +0100
Subject: [PATCH 01/25] build arch package on CLI

---
 .github/workflows/aur.yml           |  95 --------------
 .github/workflows/linux-makepkg.yml | 197 ++++++++++++++++++++++++++++
 dist/linux/aur/PKGBUILD             | 116 ++++++++++++++++
 3 files changed, 313 insertions(+), 95 deletions(-)
 delete mode 100644 .github/workflows/aur.yml
 create mode 100644 .github/workflows/linux-makepkg.yml
 create mode 100644 dist/linux/aur/PKGBUILD

diff --git a/.github/workflows/aur.yml b/.github/workflows/aur.yml
deleted file mode 100644
index 303ce398c..000000000
--- a/.github/workflows/aur.yml
+++ /dev/null
@@ -1,95 +0,0 @@
-name: Create PR for AUR
-
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Release tag'
-        required: true
-
-jobs:
-  get-version:
-    uses: ./.github/workflows/get-version.yml
-    with:
-      version: ${{ inputs.tag }}
-  tarball:
-    name: Determines tarball url and compute checksum
-    runs-on: ubuntu-latest
-    needs: [get-version]
-    if:  github.event_name == 'workflow_dispatch' || needs.get-version.outputs.versionType == 'stable'
-    env:
-      INPUT_TAG: ${{ inputs.tag }}
-    outputs:
-      url: ${{ steps.url.outputs.url}}
-      sha256: ${{ steps.sha256.outputs.sha256}}
-    steps:
-      - name: Determine tarball url
-        id: url
-        run: |
-          URL="";
-          if [[ -n "${INPUT_TAG}"  ]]; then
-            URL="https://github.com/cryptomator/cryptomator/archive/refs/tags/${INPUT_TAG}.tar.gz"
-          else
-            URL="https://github.com/cryptomator/cryptomator/archive/refs/tags/${{ github.event.release.tag_name }}.tar.gz"
-          fi
-          echo "url=${URL}" >> "$GITHUB_OUTPUT"
-      - name: Download source tarball and compute checksum
-        id: sha256
-        run: |
-          curl --silent --fail-with-body -L -H "Accept: application/vnd.github+json" ${{ steps.url.outputs.url }} --output cryptomator.tar.gz
-          TARBALL_SHA256=$(sha256sum cryptomator.tar.gz | cut -d ' ' -f1)
-          echo "sha256=${TARBALL_SHA256}" >> "$GITHUB_OUTPUT"
-  aur:
-    name: Create PR for AUR
-    runs-on: ubuntu-latest
-    needs: [tarball, get-version]
-    env:
-      AUR_PR_URL: tbd
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          repository: 'cryptomator/aur'
-          token: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
-      - name: Install dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install makepkg pacman-package-manager
-      - name: Checkout release branch
-        run: |
-          git checkout -b release/${{ needs.get-version.outputs.semVerStr }}
-      - name: Update build file
-        run: |
-          sed -i -e 's|^pkgver=.*$|pkgver=${{ needs.get-version.outputs.semVerStr }}|' PKGBUILD
-          sed -i -e 's|^pkgrel=.*$|pkgrel=1|' PKGBUILD
-          sed -i -e "s|^sha256sums=.*$|sha256sums=('${{ needs.tarball.outputs.sha256 }}'|" PKGBUILD
-          makepkg --printsrcinfo > .SRCINFO
-      - name: Commit and push
-        run: |
-          git config user.name "${{ github.actor }}"
-          git config user.email "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
-          git config push.autoSetupRemote true
-          git stage .
-          git commit -m "Prepare release ${{needs.get-version.outputs.semVerStr}}"
-          git push
-      - name: Create pull request
-        run: |
-          printf "> [!IMPORTANT]\n> Todos:\n> - [ ] Update build instructions\n> - [ ] Check for JDK update\n> - [ ] Check for JFX update" > pr_body.md
-          PR_URL=$(gh pr create --title "Release ${{ needs.get-version.outputs.semVerStr }}" --body-file pr_body.md)
-          echo "AUR_PR_URL=$PR_URL" >> "$GITHUB_ENV"
-        env:
-          GH_TOKEN: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
-      - name: Slack Notification
-        if: github.event_name == 'release'
-        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
-        env:
-          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
-          SLACK_USERNAME: 'Cryptobot'
-          SLACK_ICON: false
-          SLACK_ICON_EMOJI: ':bot:'
-          SLACK_CHANNEL: 'cryptomator-desktop'
-          SLACK_TITLE: "AUR release PR created for ${{ github.event.repository.name }} ${{ github.event.release.tag_name }} created."
-          SLACK_MESSAGE: "See <${{ env.AUR_PR_URL }}|PR> on how to proceed."
-          SLACK_FOOTER: false
-          MSG_MINIMAL: true
\ No newline at end of file
diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
new file mode 100644
index 000000000..60638cb5b
--- /dev/null
+++ b/.github/workflows/linux-makepkg.yml
@@ -0,0 +1,197 @@
+name: Build Arch package
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version'
+        required: false
+      create-pr:
+          description: 'Create a PR for AUR mirror'
+          type: boolean
+          default: false
+  push:
+    branches-ignore:
+      - 'dependabot/**'
+    paths:
+      - '.github/workflows/aur.yml'
+      - 'dist/linux/aur/**'
+      - 'dist/linux/common/**'
+      - 'dist/linux/resources/**'
+
+jobs:
+  get-version:
+    uses: ./.github/workflows/get-version.yml
+    with:
+      version: ${{ inputs.version }}
+
+  makepkg:
+    name: Build with makepkg
+    needs: [get-version]
+    runs-on: ubuntu-latest
+    container:
+      image: archlinux:base-devel
+    env:
+      PKGDEST: ${{ github.workspace }}/pkgdest
+      SRCDEST: ${{ github.workspace }}/srcdest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Prepare pacman
+        run: |
+          pacman-key --init
+          pacman-key --populate archlinux
+          pacman -Syu --noconfirm --needed git base-devel sudo gnupg maven unzip
+      - name: Create build user
+        run: |
+          useradd -m builder
+          echo 'builder ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers.d/builder
+          chown -R builder:builder "$GITHUB_WORKSPACE"
+          install -d -m 0755 -o builder -g builder "$PKGDEST" "$SRCDEST"
+      - name: Set package version
+        run: |
+          sed -i -e 's|^pkgver=.*$|pkgver=${{ needs.get-version.outputs.semVerStr }}|' dist/linux/aur/PKGBUILD
+      - name: Build package with makepkg
+        working-directory: dist/linux/aur
+        run: |
+          sudo -u builder env \
+            PKGDEST="$PKGDEST" \
+            SRCDEST="$SRCDEST" \
+            makepkg --syncdeps --cleanbuild --noconfirm --log
+      - name: Upload package artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: arch-package-${{ github.run_number }}
+          if-no-files-found: error
+          path: |
+            ${{ env.PKGDEST }}/*.pkg.tar.zst
+
+  tarball:
+    name: Determines tarball url and compute checksum
+    runs-on: ubuntu-latest
+    needs: [get-version]
+    if:  github.event_name == 'workflow_dispatch' && inputs.create-pr || needs.get-version.outputs.versionType == 'stable'
+    outputs:
+      url: ${{ steps.url.outputs.url}}
+      sha256: ${{ steps.sha256.outputs.sha256}}
+    steps:
+      - name: Determine tarball url
+        id: url
+        run: |
+          URL="";
+          if [[ -n "${INPUT_VERSION}"  ]]; then
+            URL="https://github.com/cryptomator/cryptomator/archive/refs/tags/${INPUT_VERSION}.tar.gz"
+          else
+            URL="https://github.com/cryptomator/cryptomator/archive/refs/tags/${{ github.event.release.tag_name }}.tar.gz"
+          fi
+          echo "url=${URL}" >> "$GITHUB_OUTPUT"
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+      - name: Download source tarball and compute checksum
+        id: sha256
+        run: |
+          curl --silent --fail-with-body -L -H "Accept: application/vnd.github+json" ${{ steps.url.outputs.url }} --output cryptomator.tar.gz
+          TARBALL_SHA256=$(sha256sum cryptomator.tar.gz | cut -d ' ' -f1)
+          echo "sha256=${TARBALL_SHA256}" >> "$GITHUB_OUTPUT"
+
+  aur:
+    name: Create PR for AUR
+    runs-on: ubuntu-latest
+    needs: [tarball, get-version]
+    container:
+      image: archlinux:base-devel
+    env:
+      PKGDEST: ${{ github.workspace }}/pkgdest
+      SRCDEST: ${{ github.workspace }}/srcdest
+    steps:
+      - name: Prepare pacman
+        run: |
+          pacman-key --init
+          pacman-key --populate archlinux
+          pacman -Syu --noconfirm --needed git base-devel sudo gnupg maven unzip github-cli
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: 'cryptomator/aur'
+          token: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
+      - name: Create build user
+        run: |
+          useradd -m builder
+          echo 'builder ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers.d/builder
+          chown -R builder:builder "$GITHUB_WORKSPACE"
+          install -d -m 0755 -o builder -g builder "$PKGDEST" "$SRCDEST"
+      - name: Import Cryptomator release signing key
+        # try first ubuntu. on failure try openpgp keyservers
+        run: |
+          sudo -u builder gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 58117AFA1F85B3EEC154677D615D449FE6E6A235 || \
+            sudo -u builder gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys 58117AFA1F85B3EEC154677D615D449FE6E6A235
+      - name: Checkout release branch
+        run: |
+          git checkout -b release/${{ needs.get-version.outputs.semVerStr }}
+      - name: Determine pkgrel
+        id: pkgrel
+        run: |
+          TARGET_VERSION='${{ needs.get-version.outputs.semVerStr }}'
+          CURRENT_VERSION="$(sed -nE 's/^pkgver=(.*)$/\1/p' PKGBUILD | head -n1)"
+          CURRENT_REL="$(sed -nE 's/^pkgrel=([0-9]+).*$/\1/p' PKGBUILD | head -n1)"
+
+          if [[ "$CURRENT_VERSION" == "$TARGET_VERSION" && "$CURRENT_REL" =~ ^[0-9]+$ ]]; then
+            NEXT_REL=$((CURRENT_REL + 1))
+            REL_MODE="bump"
+          else
+            NEXT_REL=1
+            REL_MODE="reset"
+          fi
+
+          echo "value=${NEXT_REL}" >> "$GITHUB_OUTPUT"
+          echo "mode=${REL_MODE}" >> "$GITHUB_OUTPUT"
+      - name: Update build file
+        run: |
+          sed -i -e 's|^pkgver=.*$|pkgver=${{ needs.get-version.outputs.semVerStr }}|' PKGBUILD
+          sed -i -e 's|^pkgrel=.*$|pkgrel=${{ steps.pkgrel.outputs.value }}|' PKGBUILD
+          sed -i -e 's|^source=.*$|$TAR_SOURCE|' PKGBUILD
+          sed -i -e "s|^sha256sums=.*$|$TAR_SHA|" PKGBUILD
+          makepkg --printsrcinfo > .SRCINFO
+        env:
+          TAR_SOURCE: |-
+            source=("cryptomator-${pkgver//_/-}.tar.gz::https://github.com/cryptomator/cryptomator/archive/refs/tags/${pkgver//_/-}.tar.gz"
+                    "cryptomator-${pkgver//_/-}.tar.gz.asc::https://github.com/cryptomator/cryptomator/releases/download/${pkgver//_/-}/cryptomator-${pkgver//_/-}.tar.gz.asc")
+          TAR_SHA: |-
+            sha256sums=('${{needs.tarball.outputs.sha256}}'
+                        'SKIP')
+      - name: Build package with makepkg
+        run: |
+          sudo -u builder env \
+            PKGDEST="$PKGDEST" \
+            SRCDEST="$SRCDEST" \
+            makepkg --syncdeps --cleanbuild --noconfirm --log
+      - name: Commit and push
+        run: |
+          git config user.name "cryptobot"
+          git config user.email "automation@cryptomator.org  "
+          git config push.autoSetupRemote true
+          git stage .
+          git commit -m "Prepare release ${{ needs.get-version.outputs.semVerStr }}-${{ steps.pkgrel.outputs.value }} (${{ steps.pkgrel.outputs.mode }} pkgrel)"
+          git push
+      - name: Create pull request
+        id: create-pr
+        run: |
+          printf "> [!IMPORTANT]\n> Todos:\n> - [ ] Update build instructions\n> - [ ] Check for JDK update\n> - [ ] Check for JFX update" > pr_body.md
+          PR_URL=$(gh pr create --title "Release ${{ needs.get-version.outputs.semVerStr }}" --body-file pr_body.md)
+          echo "url=$PR_URL" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
+      - name: Slack Notification
+        if: github.event_name == 'release'
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
+        env:
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_CRYPTOMATOR_DESKTOP }}
+          SLACK_USERNAME: 'Cryptobot'
+          SLACK_ICON: false
+          SLACK_ICON_EMOJI: ':bot:'
+          SLACK_CHANNEL: 'cryptomator-desktop'
+          SLACK_TITLE: "AUR release PR created for ${{ github.event.repository.name }} ${{ github.event.release.tag_name }} created."
+          SLACK_MESSAGE: "See <${{ steps.create-pr.outputs.url }}|PR> on how to proceed."
+          SLACK_FOOTER: false
+          MSG_MINIMAL: true
diff --git a/dist/linux/aur/PKGBUILD b/dist/linux/aur/PKGBUILD
new file mode 100644
index 000000000..222d53624
--- /dev/null
+++ b/dist/linux/aur/PKGBUILD
@@ -0,0 +1,116 @@
+# Maintainer: Aaron Graves <linux@ajgraves.com>
+# Contributor: Julian Raufelder <arch@raufelder.com>
+# Contributor: Morten Linderud <morten@linderud.pw>
+# Contributor: Sebastian Stenzel <sebastian.stenzel@gmail.com>
+# Contributor: Armin Schrenk <armin.schrenk@skymatic.de>
+
+pkgname=cryptomator
+pkgver=1.19.0_SNAPSHOT
+pkgrel=1
+pkgdesc="Multiplatform transparent client-side encryption of your files in the cloud."
+arch=('any')
+url="https://cryptomator.org/"
+license=('GPL3')
+depends=('fuse3' 'alsa-lib' 'hicolor-icon-theme' 'libxtst' 'libnet' 'libxrender')
+makedepends=('maven' 'unzip')
+optdepends=('keepassxc-cryptomator: Use KeePassXC to store vault passwords' 'ttf-hanazono: Install this font when using Japanese system language')
+_jdkver=24.0.1+9
+_jfxver=25
+_src_app_dir=cryptomator-${pkgver//_/-}
+source=("${_src_app_dir}::git+file://${startdir}/../../..");
+source_x86_64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jdkver:0:2}-binaries/releases/download/jdk-${_jdkver//\+/%2B}/OpenJDK${_jdkver:0:2}U-jdk_x64_linux_hotspot_${_jdkver//\+/_}.tar.gz"
+               "openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-x64_bin-jmods.zip")
+source_aarch64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jdkver:0:2}-binaries/releases/download/jdk-${_jdkver//\+/%2B}/OpenJDK${_jdkver:0:2}U-jdk_aarch64_linux_hotspot_${_jdkver//\+/_}.tar.gz"
+                "openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-aarch64_bin-jmods.zip")
+noextract=("jdk-${_jdkver}.tar.gz" "openjfx-${_jfxver}.zip")
+sha256sums=('SKIP')
+sha256sums_x86_64=('78832cb5ea4074f2215cde0d01d6192d09c87636fc24b36647aea61fb23b8272'
+                   '96e520f48610d8ffb94ca30face1f11ffe8a977ddc1c4ff80b1a9e9f048bd94e')
+sha256sums_aarch64=('a598260e340028d9b2383c23df16aa286769a661bd3bf28a52e8c1a5774b1110'
+                    '9ad4ca7b769ca4ee6419f1e99143dd6ff812f8be4fddb46a7d7cacbeea148af4')
+options=('!strip')
+
+validpgpkeys=('58117AFA1F85B3EEC154677D615D449FE6E6A235')
+
+build() {
+  export JAVA_HOME="${srcdir}/jdk-${_jdkver}"
+  JMODS_PATH="${srcdir}/openjfx-${_jfxver}-jmods"
+  #JEP 493
+  if ! $(${JAVA_HOME}/bin/jlink --help | grep -q "Linking from run-time image enabled"); then
+      JMODS_PATH="${JMODS_PATH}:${JAVA_HOME}/jmods:"
+  fi
+
+  tar xfz "jdk-${_jdkver}.tar.gz"
+
+  mkdir "openjfx-${_jfxver}-jmods"
+  unzip -j "openjfx-${_jfxver}.zip" \*/javafx.base.jmod \*/javafx.controls.jmod \*/javafx.fxml.jmod \*/javafx.graphics.jmod -d "openjfx-${_jfxver}-jmods"
+
+  cd "${srcdir}/${_src_app_dir}"
+
+  mvn -B clean package -DskipTests -Plinux
+
+  cp LICENSE.txt target
+  cp target/cryptomator-*.jar target/mods
+
+  cd target
+
+  "$JAVA_HOME/bin/jlink" \
+    --output runtime \
+    --module-path "$JMODS_PATH" \
+    --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported,jdk.security.auth,jdk.accessibility,jdk.management.jfr,jdk.net,java.compiler \
+    --strip-native-commands \
+    --no-header-files \
+    --no-man-pages \
+    --strip-debug \
+    --compress=zip-0
+
+  ##Note: jpackage does not allow -beta suffixes, have to strip those
+  "$JAVA_HOME/bin/jpackage" \
+    --type app-image \
+    --runtime-image runtime \
+    --input libs \
+    --module-path mods \
+    --module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator \
+    --dest . \
+    --name cryptomator \
+    --vendor "Skymatic GmbH" \
+    --copyright "(C) 2016 - 2025 Skymatic GmbH" \
+    --java-options '--enable-native-access=javafx.graphics,org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64,org.purejava.appindicator' \
+    --java-options "--sun-misc-unsafe-memory-access=allow" \
+    --java-options "-Xss5m" \
+    --java-options "-Xmx256m" \
+    --java-options "-Dfile.encoding=\"utf-8\"" \
+    --java-options "-Djava.net.useSystemProxies=true" \
+    --java-options "-Dcryptomator.logDir=\"@{userhome}/.local/share/Cryptomator/logs\"" \
+    --java-options "-Dcryptomator.pluginDir=\"@{userhome}/.local/share/Cryptomator/plugins\"" \
+    --java-options "-Dcryptomator.settingsPath=\"@{userhome}/.config/Cryptomator/settings.json:~/.Cryptomator/settings.json\"" \
+    --java-options "-Dcryptomator.p12Path=\"@{userhome}/.config/Cryptomator/key.p12\"" \
+    --java-options "-Dcryptomator.ipcSocketPath=\"@{userhome}/.config/Cryptomator/ipc.socket\"" \
+    --java-options "-Dcryptomator.mountPointsDir=\"@{userhome}/.local/share/Cryptomator/mnt\"" \
+    --java-options "-Dcryptomator.showTrayIcon=true" \
+    --java-options "-Dcryptomator.disableUpdateCheck=true" \
+    --java-options "-Dcryptomator.buildNumber=\"aur-${pkgrel}\"" \
+    --java-options "-Dcryptomator.appVersion=\"${pkgver//_/-}\"" \
+    --java-options "-Dcryptomator.integrationsLinux.autoStartCmd=\"cryptomator\"" \
+    --java-options "-Dcryptomator.networking.truststore.p12Path=\"/etc/cryptomator/certs.p12\"" \
+    --app-version "${pkgver//_*/}" \
+    --verbose
+}
+
+package() {
+  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/application-vnd.cryptomator.vault.xml" "${pkgdir}/usr/share/mime/packages/cryptomator-vault.xml"
+  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.desktop" "${pkgdir}/usr/share/applications/org.cryptomator.Cryptomator.desktop"
+  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator256.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/org.cryptomator.Cryptomator.png"
+  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator512.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/org.cryptomator.Cryptomator.png"
+  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.svg"
+  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.tray.svg"
+  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray-unlocked.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/org.cryptomator.Cryptomator.tray-unlocked.svg"
+  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray.svg" "${pkgdir}/usr/share/icons/hicolor/symbolic/apps/org.cryptomator.Cryptomator.tray-symbolic.svg"
+  install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray-unlocked.svg" "${pkgdir}/usr/share/icons/hicolor/symbolic/apps/org.cryptomator.Cryptomator.tray-unlocked-symbolic.svg"
+
+  cp -R "${srcdir}/${_src_app_dir}/target/cryptomator" "${pkgdir}/opt/"
+  install -Dm644 "${srcdir}/${_src_app_dir}/target/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+
+  mkdir -p "${pkgdir}/usr/bin"
+  ln -s "/opt/cryptomator/bin/cryptomator" "${pkgdir}/usr/bin/cryptomator"
+}

From 00e824a1ba5638f73919d3e1999dacd6ffef09cd Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 13 Feb 2026 13:24:04 +0100
Subject: [PATCH 02/25] fix workflow

---
 .github/workflows/linux-makepkg.yml | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 60638cb5b..da47d8c05 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -37,8 +37,7 @@ jobs:
       PKGDEST: ${{ github.workspace }}/pkgdest
       SRCDEST: ${{ github.workspace }}/srcdest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Prepare pacman
         run: |
           pacman-key --init
@@ -60,8 +59,7 @@ jobs:
             PKGDEST="$PKGDEST" \
             SRCDEST="$SRCDEST" \
             makepkg --syncdeps --cleanbuild --noconfirm --log
-      - name: Upload package artifact
-        uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: arch-package-${{ github.run_number }}
           if-no-files-found: error
@@ -71,7 +69,7 @@ jobs:
   tarball:
     name: Determines tarball url and compute checksum
     runs-on: ubuntu-latest
-    needs: [get-version]
+    needs: [get-version, makepkg]
     if:  github.event_name == 'workflow_dispatch' && inputs.create-pr || needs.get-version.outputs.versionType == 'stable'
     outputs:
       url: ${{ steps.url.outputs.url}}

From fdaf5d1c36d37262d90aa1b478747d6e7a998a2c Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 13 Feb 2026 13:29:38 +0100
Subject: [PATCH 03/25] rename 'aur' dir to ' makepkg'

mention the format rather a specific repository
---
 .github/workflows/linux-makepkg.yml  | 8 ++++----
 dist/linux/{aur => makepkg}/PKGBUILD | 0
 2 files changed, 4 insertions(+), 4 deletions(-)
 rename dist/linux/{aur => makepkg}/PKGBUILD (100%)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index da47d8c05..40a89b486 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -16,8 +16,8 @@ on:
     branches-ignore:
       - 'dependabot/**'
     paths:
-      - '.github/workflows/aur.yml'
-      - 'dist/linux/aur/**'
+      - '.github/workflows/linux-makepkg.yml'
+      - 'dist/linux/makepkg/**'
       - 'dist/linux/common/**'
       - 'dist/linux/resources/**'
 
@@ -51,9 +51,9 @@ jobs:
           install -d -m 0755 -o builder -g builder "$PKGDEST" "$SRCDEST"
       - name: Set package version
         run: |
-          sed -i -e 's|^pkgver=.*$|pkgver=${{ needs.get-version.outputs.semVerStr }}|' dist/linux/aur/PKGBUILD
+          sed -i -e 's|^pkgver=.*$|pkgver=${{ needs.get-version.outputs.semVerStr }}|' dist/linux/makepkg/PKGBUILD
       - name: Build package with makepkg
-        working-directory: dist/linux/aur
+        working-directory: dist/linux/makepkg
         run: |
           sudo -u builder env \
             PKGDEST="$PKGDEST" \
diff --git a/dist/linux/aur/PKGBUILD b/dist/linux/makepkg/PKGBUILD
similarity index 100%
rename from dist/linux/aur/PKGBUILD
rename to dist/linux/makepkg/PKGBUILD

From 1a51642eb10412086efe8b1c90f23bbe5873fdc1 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 13 Feb 2026 13:30:47 +0100
Subject: [PATCH 04/25] fix workflow

---
 .github/workflows/linux-makepkg.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 40a89b486..6dba7e0e1 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -148,7 +148,7 @@ jobs:
         run: |
           sed -i -e 's|^pkgver=.*$|pkgver=${{ needs.get-version.outputs.semVerStr }}|' PKGBUILD
           sed -i -e 's|^pkgrel=.*$|pkgrel=${{ steps.pkgrel.outputs.value }}|' PKGBUILD
-          sed -i -e 's|^source=.*$|$TAR_SOURCE|' PKGBUILD
+          sed -i -e "s|^source=.*$|$TAR_SOURCE|" PKGBUILD
           sed -i -e "s|^sha256sums=.*$|$TAR_SHA|" PKGBUILD
           makepkg --printsrcinfo > .SRCINFO
         env:

From 9c88fbab5e3b5d435ad38bcf97b81b8f409df8c6 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 13 Feb 2026 13:41:54 +0100
Subject: [PATCH 05/25] merge tarball job into pr creation job

---
 .github/workflows/linux-makepkg.yml | 51 ++++++++++-------------------
 1 file changed, 17 insertions(+), 34 deletions(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 6dba7e0e1..ecedb0e58 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -66,38 +66,11 @@ jobs:
           path: |
             ${{ env.PKGDEST }}/*.pkg.tar.zst
 
-  tarball:
-    name: Determines tarball url and compute checksum
+  create-pr:
+    name: Create PR for AUR
+    if:  github.event_name == 'workflow_dispatch' && inputs.create-pr || needs.get-version.outputs.versionType == 'stable'
     runs-on: ubuntu-latest
     needs: [get-version, makepkg]
-    if:  github.event_name == 'workflow_dispatch' && inputs.create-pr || needs.get-version.outputs.versionType == 'stable'
-    outputs:
-      url: ${{ steps.url.outputs.url}}
-      sha256: ${{ steps.sha256.outputs.sha256}}
-    steps:
-      - name: Determine tarball url
-        id: url
-        run: |
-          URL="";
-          if [[ -n "${INPUT_VERSION}"  ]]; then
-            URL="https://github.com/cryptomator/cryptomator/archive/refs/tags/${INPUT_VERSION}.tar.gz"
-          else
-            URL="https://github.com/cryptomator/cryptomator/archive/refs/tags/${{ github.event.release.tag_name }}.tar.gz"
-          fi
-          echo "url=${URL}" >> "$GITHUB_OUTPUT"
-        env:
-          INPUT_VERSION: ${{ inputs.version }}
-      - name: Download source tarball and compute checksum
-        id: sha256
-        run: |
-          curl --silent --fail-with-body -L -H "Accept: application/vnd.github+json" ${{ steps.url.outputs.url }} --output cryptomator.tar.gz
-          TARBALL_SHA256=$(sha256sum cryptomator.tar.gz | cut -d ' ' -f1)
-          echo "sha256=${TARBALL_SHA256}" >> "$GITHUB_OUTPUT"
-
-  aur:
-    name: Create PR for AUR
-    runs-on: ubuntu-latest
-    needs: [tarball, get-version]
     container:
       image: archlinux:base-devel
     env:
@@ -109,7 +82,17 @@ jobs:
           pacman-key --init
           pacman-key --populate archlinux
           pacman -Syu --noconfirm --needed git base-devel sudo gnupg maven unzip github-cli
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Download source tarball and compute checksum
+        id: sha256
+        run: |
+          URL="https://github.com/cryptomator/cryptomator/archive/refs/tags/${TAG}.tar.gz"
+          curl --silent --fail-with-body -L -H "Accept: application/vnd.github+json" ${URL} --output cryptomator.tar.gz
+          TARBALL_SHA256=$(sha256sum cryptomator.tar.gz | cut -d ' ' -f1)
+          echo "value=${TARBALL_SHA256}" >> "$GITHUB_OUTPUT"
+        env:
+          TAG: ${{ needs.get-version.outputs.semVerNum || github.event.release.tag_name }}
+      - name: Checkout cryptomator/aur repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: 'cryptomator/aur'
           token: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
@@ -150,13 +133,13 @@ jobs:
           sed -i -e 's|^pkgrel=.*$|pkgrel=${{ steps.pkgrel.outputs.value }}|' PKGBUILD
           sed -i -e "s|^source=.*$|$TAR_SOURCE|" PKGBUILD
           sed -i -e "s|^sha256sums=.*$|$TAR_SHA|" PKGBUILD
-          makepkg --printsrcinfo > .SRCINFO
+          sudo -u builder makepkg --printsrcinfo > .SRCINFO
         env:
           TAR_SOURCE: |-
             source=("cryptomator-${pkgver//_/-}.tar.gz::https://github.com/cryptomator/cryptomator/archive/refs/tags/${pkgver//_/-}.tar.gz"
                     "cryptomator-${pkgver//_/-}.tar.gz.asc::https://github.com/cryptomator/cryptomator/releases/download/${pkgver//_/-}/cryptomator-${pkgver//_/-}.tar.gz.asc")
           TAR_SHA: |-
-            sha256sums=('${{needs.tarball.outputs.sha256}}'
+            sha256sums=('${{steps.sha256.outputs.value}}'
                         'SKIP')
       - name: Build package with makepkg
         run: |
@@ -167,7 +150,7 @@ jobs:
       - name: Commit and push
         run: |
           git config user.name "cryptobot"
-          git config user.email "automation@cryptomator.org  "
+          git config user.email "automation@cryptomator.org"
           git config push.autoSetupRemote true
           git stage .
           git commit -m "Prepare release ${{ needs.get-version.outputs.semVerStr }}-${{ steps.pkgrel.outputs.value }} (${{ steps.pkgrel.outputs.mode }} pkgrel)"

From 2e698317e58d01c0411c55f71f91bc11f40430a5 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 13 Feb 2026 13:50:39 +0100
Subject: [PATCH 06/25] Indirect github action inputs with env vars

---
 .github/workflows/linux-makepkg.yml | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index ecedb0e58..7487ea1dc 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -109,7 +109,9 @@ jobs:
             sudo -u builder gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys 58117AFA1F85B3EEC154677D615D449FE6E6A235
       - name: Checkout release branch
         run: |
-          git checkout -b release/${{ needs.get-version.outputs.semVerStr }}
+          git checkout -b release/${BRANCHNAME}
+        env:
+          BRANCH_NAME: ${{ needs.get-version.outputs.semVerStr }}
       - name: Determine pkgrel
         id: pkgrel
         run: |
@@ -119,22 +121,21 @@ jobs:
 
           if [[ "$CURRENT_VERSION" == "$TARGET_VERSION" && "$CURRENT_REL" =~ ^[0-9]+$ ]]; then
             NEXT_REL=$((CURRENT_REL + 1))
-            REL_MODE="bump"
           else
             NEXT_REL=1
-            REL_MODE="reset"
           fi
 
           echo "value=${NEXT_REL}" >> "$GITHUB_OUTPUT"
-          echo "mode=${REL_MODE}" >> "$GITHUB_OUTPUT"
       - name: Update build file
         run: |
-          sed -i -e 's|^pkgver=.*$|pkgver=${{ needs.get-version.outputs.semVerStr }}|' PKGBUILD
-          sed -i -e 's|^pkgrel=.*$|pkgrel=${{ steps.pkgrel.outputs.value }}|' PKGBUILD
+          sed -i -e "s|^pkgver=.*$|pkgver=$SEM_VERSION|" PKGBUILD
+          sed -i -e "s|^pkgrel=.*$|pkgrel=$PKG_REL|" PKGBUILD
           sed -i -e "s|^source=.*$|$TAR_SOURCE|" PKGBUILD
           sed -i -e "s|^sha256sums=.*$|$TAR_SHA|" PKGBUILD
           sudo -u builder makepkg --printsrcinfo > .SRCINFO
         env:
+          SEM_VERSION: ${{ needs.get-version.outputs.semVerStr }}
+          PKG_REL: ${{ steps.pkgrel.outputs.value }}
           TAR_SOURCE: |-
             source=("cryptomator-${pkgver//_/-}.tar.gz::https://github.com/cryptomator/cryptomator/archive/refs/tags/${pkgver//_/-}.tar.gz"
                     "cryptomator-${pkgver//_/-}.tar.gz.asc::https://github.com/cryptomator/cryptomator/releases/download/${pkgver//_/-}/cryptomator-${pkgver//_/-}.tar.gz.asc")
@@ -153,15 +154,18 @@ jobs:
           git config user.email "automation@cryptomator.org"
           git config push.autoSetupRemote true
           git stage .
-          git commit -m "Prepare release ${{ needs.get-version.outputs.semVerStr }}-${{ steps.pkgrel.outputs.value }} (${{ steps.pkgrel.outputs.mode }} pkgrel)"
+          git commit -m "Prepare release ${VERSION}"
           git push
+        env:
+          VERSION: ${{ needs.get-version.outputs.semVerStr }}-${{ steps.pkgrel.outputs.value }}
       - name: Create pull request
         id: create-pr
         run: |
           printf "> [!IMPORTANT]\n> Todos:\n> - [ ] Update build instructions\n> - [ ] Check for JDK update\n> - [ ] Check for JFX update" > pr_body.md
-          PR_URL=$(gh pr create --title "Release ${{ needs.get-version.outputs.semVerStr }}" --body-file pr_body.md)
+          PR_URL=$(gh pr create --title "Release $VERSION" --body-file pr_body.md)
           echo "url=$PR_URL" >> "$GITHUB_OUTPUT"
         env:
+          VERSION: ${{ needs.get-version.outputs.semVerStr }}-${{ steps.pkgrel.outputs.value }}
           GH_TOKEN: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
       - name: Slack Notification
         if: github.event_name == 'release'

From b9d21b1b7a479c292059a2b21b1ce7eee3616326 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 13 Feb 2026 13:55:56 +0100
Subject: [PATCH 07/25] replace hypens with underscore in pkgbuild version

---
 .github/workflows/linux-makepkg.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 7487ea1dc..f8cba58b3 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -51,7 +51,9 @@ jobs:
           install -d -m 0755 -o builder -g builder "$PKGDEST" "$SRCDEST"
       - name: Set package version
         run: |
-          sed -i -e 's|^pkgver=.*$|pkgver=${{ needs.get-version.outputs.semVerStr }}|' dist/linux/makepkg/PKGBUILD
+          sed -i -e 's|^pkgver=.*$|pkgver=${VERSION//-/_}|' dist/linux/makepkg/PKGBUILD
+        env:
+          VERSION: ${{ needs.get-version.outputs.semVerStr }}
       - name: Build package with makepkg
         working-directory: dist/linux/makepkg
         run: |

From 35f39a9eafee1c3fccf9226c06ac70a7fdbe8a46 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 13 Feb 2026 13:58:04 +0100
Subject: [PATCH 08/25] minor fixes

---
 .github/workflows/linux-makepkg.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index f8cba58b3..915cde710 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -111,9 +111,9 @@ jobs:
             sudo -u builder gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys 58117AFA1F85B3EEC154677D615D449FE6E6A235
       - name: Checkout release branch
         run: |
-          git checkout -b release/${BRANCHNAME}
+          git checkout -b release/${VERSION}
         env:
-          BRANCH_NAME: ${{ needs.get-version.outputs.semVerStr }}
+          VERSION: ${{ needs.get-version.outputs.semVerStr }}
       - name: Determine pkgrel
         id: pkgrel
         run: |
@@ -178,7 +178,7 @@ jobs:
           SLACK_ICON: false
           SLACK_ICON_EMOJI: ':bot:'
           SLACK_CHANNEL: 'cryptomator-desktop'
-          SLACK_TITLE: "AUR release PR created for ${{ github.event.repository.name }} ${{ github.event.release.tag_name }} created."
+          SLACK_TITLE: "AUR release PR created for ${{ github.event.repository.name }} ${{ github.event.release.tag_name }}."
           SLACK_MESSAGE: "See <${{ steps.create-pr.outputs.url }}|PR> on how to proceed."
           SLACK_FOOTER: false
           MSG_MINIMAL: true

From 49f070977aaef056d4fca7af7f474fa2561bbc5f Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 13 Feb 2026 13:59:11 +0100
Subject: [PATCH 09/25] use proper quotes

---
 .github/workflows/linux-makepkg.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 915cde710..e9f9f7cc4 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -51,7 +51,7 @@ jobs:
           install -d -m 0755 -o builder -g builder "$PKGDEST" "$SRCDEST"
       - name: Set package version
         run: |
-          sed -i -e 's|^pkgver=.*$|pkgver=${VERSION//-/_}|' dist/linux/makepkg/PKGBUILD
+          sed -i -e "s|^pkgver=.*$|pkgver=${VERSION//-/_}|" dist/linux/makepkg/PKGBUILD
         env:
           VERSION: ${{ needs.get-version.outputs.semVerStr }}
       - name: Build package with makepkg

From 0fa34dba33af05f55f1503f406c04171a0cb1075 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 13 Feb 2026 17:49:45 +0100
Subject: [PATCH 10/25] replace PKGBUILD with PKGBUILD.template

use envsubst to create actual PKGBUILD
---
 .github/workflows/linux-makepkg.yml                | 13 ++++++++-----
 dist/linux/makepkg/{PKGBUILD => PKGBUILD.template} |  8 ++++----
 2 files changed, 12 insertions(+), 9 deletions(-)
 rename dist/linux/makepkg/{PKGBUILD => PKGBUILD.template} (98%)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index e9f9f7cc4..6aa31d884 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -38,6 +38,8 @@ jobs:
       SRCDEST: ${{ github.workspace }}/srcdest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          path: cryptomator
       - name: Prepare pacman
         run: |
           pacman-key --init
@@ -49,13 +51,14 @@ jobs:
           echo 'builder ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers.d/builder
           chown -R builder:builder "$GITHUB_WORKSPACE"
           install -d -m 0755 -o builder -g builder "$PKGDEST" "$SRCDEST"
-      - name: Set package version
-        run: |
-          sed -i -e "s|^pkgver=.*$|pkgver=${VERSION//-/_}|" dist/linux/makepkg/PKGBUILD
+      - name: Prepare PKGBUILD
+        run: envsubst '$PKG_VERSION PKG_RELEASE SOURCES SOURCES_SHA' < cryptomator/dist/linux/makepkg/PKGBUILD.template > PKGBUILD
         env:
-          VERSION: ${{ needs.get-version.outputs.semVerStr }}
+          PKG_VERSION: ${{ needs.get-version.outputs.semVerStr }}
+          PKG_RELEASE: 1
+          SOURCES: '"${_src_app_dir}::git+file://${{ github.workspace }}/cryptomator"'
+          SOURCES_SHA: "'SKIP'"
       - name: Build package with makepkg
-        working-directory: dist/linux/makepkg
         run: |
           sudo -u builder env \
             PKGDEST="$PKGDEST" \
diff --git a/dist/linux/makepkg/PKGBUILD b/dist/linux/makepkg/PKGBUILD.template
similarity index 98%
rename from dist/linux/makepkg/PKGBUILD
rename to dist/linux/makepkg/PKGBUILD.template
index 222d53624..051708b14 100644
--- a/dist/linux/makepkg/PKGBUILD
+++ b/dist/linux/makepkg/PKGBUILD.template
@@ -5,8 +5,8 @@
 # Contributor: Armin Schrenk <armin.schrenk@skymatic.de>
 
 pkgname=cryptomator
-pkgver=1.19.0_SNAPSHOT
-pkgrel=1
+pkgver=$PKG_VERSION
+pkgrel=$PKG_RELEASE
 pkgdesc="Multiplatform transparent client-side encryption of your files in the cloud."
 arch=('any')
 url="https://cryptomator.org/"
@@ -17,13 +17,13 @@ optdepends=('keepassxc-cryptomator: Use KeePassXC to store vault passwords' 'ttf
 _jdkver=24.0.1+9
 _jfxver=25
 _src_app_dir=cryptomator-${pkgver//_/-}
-source=("${_src_app_dir}::git+file://${startdir}/../../..");
+source=($SOURCES);
 source_x86_64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jdkver:0:2}-binaries/releases/download/jdk-${_jdkver//\+/%2B}/OpenJDK${_jdkver:0:2}U-jdk_x64_linux_hotspot_${_jdkver//\+/_}.tar.gz"
                "openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-x64_bin-jmods.zip")
 source_aarch64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jdkver:0:2}-binaries/releases/download/jdk-${_jdkver//\+/%2B}/OpenJDK${_jdkver:0:2}U-jdk_aarch64_linux_hotspot_${_jdkver//\+/_}.tar.gz"
                 "openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-aarch64_bin-jmods.zip")
 noextract=("jdk-${_jdkver}.tar.gz" "openjfx-${_jfxver}.zip")
-sha256sums=('SKIP')
+sha256sums=($SOURCES_SHA)
 sha256sums_x86_64=('78832cb5ea4074f2215cde0d01d6192d09c87636fc24b36647aea61fb23b8272'
                    '96e520f48610d8ffb94ca30face1f11ffe8a977ddc1c4ff80b1a9e9f048bd94e')
 sha256sums_aarch64=('a598260e340028d9b2383c23df16aa286769a661bd3bf28a52e8c1a5774b1110'

From 7275ec9a61e9874924e869e36ea475af766d94c1 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 13 Feb 2026 18:17:14 +0100
Subject: [PATCH 11/25] fix envsubst command

---
 .github/workflows/linux-makepkg.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 6aa31d884..58e98e722 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -52,9 +52,9 @@ jobs:
           chown -R builder:builder "$GITHUB_WORKSPACE"
           install -d -m 0755 -o builder -g builder "$PKGDEST" "$SRCDEST"
       - name: Prepare PKGBUILD
-        run: envsubst '$PKG_VERSION PKG_RELEASE SOURCES SOURCES_SHA' < cryptomator/dist/linux/makepkg/PKGBUILD.template > PKGBUILD
+        run: envsubst '$PKG_VERSION $PKG_RELEASE $SOURCES $SOURCES_SHA' < cryptomator/dist/linux/makepkg/PKGBUILD.template > PKGBUILD
         env:
-          PKG_VERSION: ${{ needs.get-version.outputs.semVerStr }}
+          PKG_VERSION: ${{ needs.get-version.outputs.semVerNum }}
           PKG_RELEASE: 1
           SOURCES: '"${_src_app_dir}::git+file://${{ github.workspace }}/cryptomator"'
           SOURCES_SHA: "'SKIP'"

From f32d0c463f6dfd10f1ae8b76903266ec5cb75e50 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 16 Feb 2026 10:03:23 +0100
Subject: [PATCH 12/25] use $GITHUB_WORKSPACE

instead of github.workspace; bug in GitHubs CI system
---
 .github/workflows/linux-makepkg.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 58e98e722..1d8c83127 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -52,11 +52,15 @@ jobs:
           chown -R builder:builder "$GITHUB_WORKSPACE"
           install -d -m 0755 -o builder -g builder "$PKGDEST" "$SRCDEST"
       - name: Prepare PKGBUILD
-        run: envsubst '$PKG_VERSION $PKG_RELEASE $SOURCES $SOURCES_SHA' < cryptomator/dist/linux/makepkg/PKGBUILD.template > PKGBUILD
+        # cannot use github.workspace due to https://github.com/actions/runner/issues/2058
+        run: |
+          export SOURCES="${SOURCES_1}${GITHUB_WORKSPACE}${SOURCES_2}"
+          envsubst '$PKG_VERSION $PKG_RELEASE $SOURCES $SOURCES_SHA' < cryptomator/dist/linux/makepkg/PKGBUILD.template > PKGBUILD
         env:
           PKG_VERSION: ${{ needs.get-version.outputs.semVerNum }}
           PKG_RELEASE: 1
-          SOURCES: '"${_src_app_dir}::git+file://${{ github.workspace }}/cryptomator"'
+          SOURCES_1: '"${_src_app_dir}::git+file://'
+          SOURCES_2: '/cryptomator"'
           SOURCES_SHA: "'SKIP'"
       - name: Build package with makepkg
         run: |

From 18ce7d333dcd1b033c96b3f84ace4d121641d41d Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 16 Feb 2026 11:01:43 +0100
Subject: [PATCH 13/25] fix build

* use JDK 25
* first install git, then checkout
---
 .github/workflows/linux-makepkg.yml  | 6 +++---
 dist/linux/makepkg/PKGBUILD.template | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 1d8c83127..473515bc0 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -37,14 +37,14 @@ jobs:
       PKGDEST: ${{ github.workspace }}/pkgdest
       SRCDEST: ${{ github.workspace }}/srcdest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          path: cryptomator
       - name: Prepare pacman
         run: |
           pacman-key --init
           pacman-key --populate archlinux
           pacman -Syu --noconfirm --needed git base-devel sudo gnupg maven unzip
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          path: cryptomator
       - name: Create build user
         run: |
           useradd -m builder
diff --git a/dist/linux/makepkg/PKGBUILD.template b/dist/linux/makepkg/PKGBUILD.template
index 051708b14..da3bb819e 100644
--- a/dist/linux/makepkg/PKGBUILD.template
+++ b/dist/linux/makepkg/PKGBUILD.template
@@ -14,7 +14,7 @@ license=('GPL3')
 depends=('fuse3' 'alsa-lib' 'hicolor-icon-theme' 'libxtst' 'libnet' 'libxrender')
 makedepends=('maven' 'unzip')
 optdepends=('keepassxc-cryptomator: Use KeePassXC to store vault passwords' 'ttf-hanazono: Install this font when using Japanese system language')
-_jdkver=24.0.1+9
+_jdkver=25.0.2+10
 _jfxver=25
 _src_app_dir=cryptomator-${pkgver//_/-}
 source=($SOURCES);
@@ -24,9 +24,9 @@ source_aarch64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jd
                 "openjfx-${_jfxver}.zip::https://download2.gluonhq.com/openjfx/${_jfxver}/openjfx-${_jfxver}_linux-aarch64_bin-jmods.zip")
 noextract=("jdk-${_jdkver}.tar.gz" "openjfx-${_jfxver}.zip")
 sha256sums=($SOURCES_SHA)
-sha256sums_x86_64=('78832cb5ea4074f2215cde0d01d6192d09c87636fc24b36647aea61fb23b8272'
+sha256sums_x86_64=('987387933b64b9833846dee373b640440d3e1fd48a04804ec01a6dbf718e8ab8'
                    '96e520f48610d8ffb94ca30face1f11ffe8a977ddc1c4ff80b1a9e9f048bd94e')
-sha256sums_aarch64=('a598260e340028d9b2383c23df16aa286769a661bd3bf28a52e8c1a5774b1110'
+sha256sums_aarch64=('a9d73e711d967dc44896d4f430f73a68fd33590dabc29a7f2fb9f593425b854c'
                     '9ad4ca7b769ca4ee6419f1e99143dd6ff812f8be4fddb46a7d7cacbeea148af4')
 options=('!strip')
 

From 2eda795219649ad45200bb7b8e2bdc80ce00a34a Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 16 Feb 2026 16:01:32 +0100
Subject: [PATCH 14/25] create cryptomator dir in opt before copy

---
 dist/linux/makepkg/PKGBUILD.template | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dist/linux/makepkg/PKGBUILD.template b/dist/linux/makepkg/PKGBUILD.template
index da3bb819e..bc70f7884 100644
--- a/dist/linux/makepkg/PKGBUILD.template
+++ b/dist/linux/makepkg/PKGBUILD.template
@@ -108,6 +108,7 @@ package() {
   install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray.svg" "${pkgdir}/usr/share/icons/hicolor/symbolic/apps/org.cryptomator.Cryptomator.tray-symbolic.svg"
   install -Dm644 "${srcdir}/${_src_app_dir}/dist/linux/common/org.cryptomator.Cryptomator.tray-unlocked.svg" "${pkgdir}/usr/share/icons/hicolor/symbolic/apps/org.cryptomator.Cryptomator.tray-unlocked-symbolic.svg"
 
+  mkdir -p "${pkgdir}/opt/cryptomator/"
   cp -R "${srcdir}/${_src_app_dir}/target/cryptomator" "${pkgdir}/opt/"
   install -Dm644 "${srcdir}/${_src_app_dir}/target/LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}"
 

From b3a5265b989bff3b84f374a15096f9bad980ab9f Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 16 Feb 2026 16:29:01 +0100
Subject: [PATCH 15/25] add adminConfig path as property

---
 dist/linux/makepkg/PKGBUILD.template | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/dist/linux/makepkg/PKGBUILD.template b/dist/linux/makepkg/PKGBUILD.template
index bc70f7884..de0553d6e 100644
--- a/dist/linux/makepkg/PKGBUILD.template
+++ b/dist/linux/makepkg/PKGBUILD.template
@@ -75,24 +75,25 @@ build() {
     --name cryptomator \
     --vendor "Skymatic GmbH" \
     --copyright "(C) 2016 - 2025 Skymatic GmbH" \
+    --java-options "--enable-preview" \
     --java-options '--enable-native-access=javafx.graphics,org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64,org.purejava.appindicator' \
-    --java-options "--sun-misc-unsafe-memory-access=allow" \
     --java-options "-Xss5m" \
     --java-options "-Xmx256m" \
     --java-options "-Dfile.encoding=\"utf-8\"" \
     --java-options "-Djava.net.useSystemProxies=true" \
-    --java-options "-Dcryptomator.logDir=\"@{userhome}/.local/share/Cryptomator/logs\"" \
-    --java-options "-Dcryptomator.pluginDir=\"@{userhome}/.local/share/Cryptomator/plugins\"" \
-    --java-options "-Dcryptomator.settingsPath=\"@{userhome}/.config/Cryptomator/settings.json:~/.Cryptomator/settings.json\"" \
-    --java-options "-Dcryptomator.p12Path=\"@{userhome}/.config/Cryptomator/key.p12\"" \
-    --java-options "-Dcryptomator.ipcSocketPath=\"@{userhome}/.config/Cryptomator/ipc.socket\"" \
-    --java-options "-Dcryptomator.mountPointsDir=\"@{userhome}/.local/share/Cryptomator/mnt\"" \
-    --java-options "-Dcryptomator.showTrayIcon=true" \
-    --java-options "-Dcryptomator.disableUpdateCheck=true" \
-    --java-options "-Dcryptomator.buildNumber=\"aur-${pkgrel}\"" \
+    --java-options "-Dcryptomator.adminConfigPath=\"/etc/cryptomator/config.properties\"" \
     --java-options "-Dcryptomator.appVersion=\"${pkgver//_/-}\"" \
+    --java-options "-Dcryptomator.buildNumber=\"aur-${pkgrel}\"" \
+    --java-options "-Dcryptomator.disableUpdateCheck=true" \
     --java-options "-Dcryptomator.integrationsLinux.autoStartCmd=\"cryptomator\"" \
+    --java-options "-Dcryptomator.ipcSocketPath=\"@{userhome}/.config/Cryptomator/ipc.socket\"" \
+    --java-options "-Dcryptomator.logDir=\"@{userhome}/.local/share/Cryptomator/logs\"" \
+    --java-options "-Dcryptomator.mountPointsDir=\"@{userhome}/.local/share/Cryptomator/mnt\"" \
     --java-options "-Dcryptomator.networking.truststore.p12Path=\"/etc/cryptomator/certs.p12\"" \
+    --java-options "-Dcryptomator.pluginDir=\"@{userhome}/.local/share/Cryptomator/plugins\"" \
+    --java-options "-Dcryptomator.p12Path=\"@{userhome}/.config/Cryptomator/key.p12\"" \
+    --java-options "-Dcryptomator.settingsPath=\"@{userhome}/.config/Cryptomator/settings.json:~/.Cryptomator/settings.json\"" \
+    --java-options "-Dcryptomator.showTrayIcon=true" \
     --app-version "${pkgver//_*/}" \
     --verbose
 }

From 5e29f08d2b4cbdc3a427570f96dc861c338bdc65 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 16 Feb 2026 16:52:27 +0100
Subject: [PATCH 16/25] make pr-creation condition more explicit

---
 .github/workflows/linux-makepkg.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 473515bc0..eabc054b0 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -77,7 +77,7 @@ jobs:
 
   create-pr:
     name: Create PR for AUR
-    if:  github.event_name == 'workflow_dispatch' && inputs.create-pr || needs.get-version.outputs.versionType == 'stable'
+    if:  github.event_name == 'workflow_dispatch' && inputs.create-pr || github.event_name == 'release' && needs.get-version.outputs.versionType == 'stable'
     runs-on: ubuntu-latest
     needs: [get-version, makepkg]
     container:

From 738bd562703db26b995de3e7ea0459fa715f33c1 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 16 Feb 2026 16:53:07 +0100
Subject: [PATCH 17/25] ensure curl is installed in container

---
 .github/workflows/linux-makepkg.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index eabc054b0..855d7b103 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -90,7 +90,7 @@ jobs:
         run: |
           pacman-key --init
           pacman-key --populate archlinux
-          pacman -Syu --noconfirm --needed git base-devel sudo gnupg maven unzip github-cli
+          pacman -Syu --noconfirm --needed git base-devel sudo gnupg maven unzip github-cli curl
       - name: Download source tarball and compute checksum
         id: sha256
         run: |

From eb369ba5bd7e54ce2fba6e4d4b00781b30d159fe Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 16 Feb 2026 16:53:25 +0100
Subject: [PATCH 18/25] use envsubst also in create-pr job

---
 .github/workflows/linux-makepkg.yml | 35 +++++++++++++++++------------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 855d7b103..7b401bcc5 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -70,10 +70,16 @@ jobs:
             makepkg --syncdeps --cleanbuild --noconfirm --log
       - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
-          name: arch-package-${{ github.run_number }}
+          name: arch-package
           if-no-files-found: error
           path: |
             ${{ env.PKGDEST }}/*.pkg.tar.zst
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: pkgbuild-file
+          if-no-files-found: error
+          path: |
+            cryptomator/dist/linux/makepkg/PKGBUILD.template
 
   create-pr:
     name: Create PR for AUR
@@ -135,22 +141,23 @@ jobs:
           fi
 
           echo "value=${NEXT_REL}" >> "$GITHUB_OUTPUT"
-      - name: Update build file
+      - name: Download PKGBUILD template
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: pkgbuild-file
+      - name: Prepare PKGBUILD
         run: |
-          sed -i -e "s|^pkgver=.*$|pkgver=$SEM_VERSION|" PKGBUILD
-          sed -i -e "s|^pkgrel=.*$|pkgrel=$PKG_REL|" PKGBUILD
-          sed -i -e "s|^source=.*$|$TAR_SOURCE|" PKGBUILD
-          sed -i -e "s|^sha256sums=.*$|$TAR_SHA|" PKGBUILD
+          envsubst '$PKG_VERSION $PKG_RELEASE $SOURCES $SOURCES_SHA' < PKGBUILD.template > PKGBUILD
           sudo -u builder makepkg --printsrcinfo > .SRCINFO
         env:
-          SEM_VERSION: ${{ needs.get-version.outputs.semVerStr }}
-          PKG_REL: ${{ steps.pkgrel.outputs.value }}
-          TAR_SOURCE: |-
-            source=("cryptomator-${pkgver//_/-}.tar.gz::https://github.com/cryptomator/cryptomator/archive/refs/tags/${pkgver//_/-}.tar.gz"
-                    "cryptomator-${pkgver//_/-}.tar.gz.asc::https://github.com/cryptomator/cryptomator/releases/download/${pkgver//_/-}/cryptomator-${pkgver//_/-}.tar.gz.asc")
-          TAR_SHA: |-
-            sha256sums=('${{steps.sha256.outputs.value}}'
-                        'SKIP')
+          PKG_VERSION: ${{ needs.get-version.outputs.semVerNum }}
+          PKG_RELEASE: ${{ steps.pkgrel.outputs.value }}
+          SOURCES: |-
+            "cryptomator-${pkgver//_/-}.tar.gz::https://github.com/cryptomator/cryptomator/archive/refs/tags/${pkgver//_/-}.tar.gz"
+                    "cryptomator-${pkgver//_/-}.tar.gz.asc::https://github.com/cryptomator/cryptomator/releases/download/${pkgver//_/-}/cryptomator-${pkgver//_/-}.tar.gz.asc"
+          SOURCES_SHA: |-
+            '${{steps.sha256.outputs.value}}'
+                        'SKIP'
       - name: Build package with makepkg
         run: |
           sudo -u builder env \

From 3fb0e9328f82c360b9782d54c10af7f637027cd4 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Mon, 16 Feb 2026 17:01:52 +0100
Subject: [PATCH 19/25] ensure curl only uses https

---
 .github/workflows/linux-makepkg.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 7b401bcc5..2dca01f57 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -101,7 +101,7 @@ jobs:
         id: sha256
         run: |
           URL="https://github.com/cryptomator/cryptomator/archive/refs/tags/${TAG}.tar.gz"
-          curl --silent --fail-with-body -L -H "Accept: application/vnd.github+json" ${URL} --output cryptomator.tar.gz
+          curl --silent --fail-with-body --proto "=https" -L -H "Accept: application/vnd.github+json" ${URL} --output cryptomator.tar.gz
           TARBALL_SHA256=$(sha256sum cryptomator.tar.gz | cut -d ' ' -f1)
           echo "value=${TARBALL_SHA256}" >> "$GITHUB_OUTPUT"
         env:

From ee5165320dd0600c66e131193314ebfa8a431395 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Thu, 19 Feb 2026 12:04:36 +0100
Subject: [PATCH 20/25] Update Git user email for automation commits

---
 .github/workflows/linux-makepkg.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 2dca01f57..338fab9e7 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -167,7 +167,7 @@ jobs:
       - name: Commit and push
         run: |
           git config user.name "cryptobot"
-          git config user.email "automation@cryptomator.org"
+          git config user.email "cryptobot@users.noreply.github.com"
           git config push.autoSetupRemote true
           git stage .
           git commit -m "Prepare release ${VERSION}"

From d5bc0914f4593ee7b8166036a19fccc1efe77f1f Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 20 Feb 2026 16:17:08 +0100
Subject: [PATCH 21/25] fix description text for PR

---
 .github/workflows/linux-makepkg.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 338fab9e7..a69a19cf2 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -177,7 +177,7 @@ jobs:
       - name: Create pull request
         id: create-pr
         run: |
-          printf "> [!IMPORTANT]\n> Todos:\n> - [ ] Update build instructions\n> - [ ] Check for JDK update\n> - [ ] Check for JFX update" > pr_body.md
+          printf "Created by event $GITHUB_EVENT_NAME in workflow $GITHUB_WORKFLOW in run $GITHUB_RUN_ID" > pr_body.md
           PR_URL=$(gh pr create --title "Release $VERSION" --body-file pr_body.md)
           echo "url=$PR_URL" >> "$GITHUB_OUTPUT"
         env:

From 1fa4d42d274635e66f0c521ab38f4375014264ce Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 20 Feb 2026 16:17:30 +0100
Subject: [PATCH 22/25] use yml multiline syntax

---
 .github/workflows/linux-makepkg.yml | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index a69a19cf2..944d0c854 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -63,11 +63,10 @@ jobs:
           SOURCES_2: '/cryptomator"'
           SOURCES_SHA: "'SKIP'"
       - name: Build package with makepkg
-        run: |
-          sudo -u builder env \
-            PKGDEST="$PKGDEST" \
-            SRCDEST="$SRCDEST" \
-            makepkg --syncdeps --cleanbuild --noconfirm --log
+        run: >
+          sudo -u builder
+          env PKGDEST="$PKGDEST" SRCDEST="$SRCDEST"
+          makepkg --syncdeps --cleanbuild --noconfirm --log
       - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: arch-package
@@ -119,12 +118,11 @@ jobs:
           install -d -m 0755 -o builder -g builder "$PKGDEST" "$SRCDEST"
       - name: Import Cryptomator release signing key
         # try first ubuntu. on failure try openpgp keyservers
-        run: |
-          sudo -u builder gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 58117AFA1F85B3EEC154677D615D449FE6E6A235 || \
-            sudo -u builder gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys 58117AFA1F85B3EEC154677D615D449FE6E6A235
+        run: >
+          sudo -u builder gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 58117AFA1F85B3EEC154677D615D449FE6E6A235
+          || sudo -u builder gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys 58117AFA1F85B3EEC154677D615D449FE6E6A235
       - name: Checkout release branch
-        run: |
-          git checkout -b release/${VERSION}
+        run: git checkout -b release/${VERSION}
         env:
           VERSION: ${{ needs.get-version.outputs.semVerStr }}
       - name: Determine pkgrel
@@ -159,11 +157,10 @@ jobs:
             '${{steps.sha256.outputs.value}}'
                         'SKIP'
       - name: Build package with makepkg
-        run: |
-          sudo -u builder env \
-            PKGDEST="$PKGDEST" \
-            SRCDEST="$SRCDEST" \
-            makepkg --syncdeps --cleanbuild --noconfirm --log
+        run: >
+          sudo -u builder
+          env PKGDEST="$PKGDEST" SRCDEST="$SRCDEST"
+          makepkg --syncdeps --cleanbuild --noconfirm --log
       - name: Commit and push
         run: |
           git config user.name "cryptobot"

From 3822136e69549ab34df78bc6a3e3ae371099ae90 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 20 Feb 2026 16:23:10 +0100
Subject: [PATCH 23/25] update year

---
 dist/linux/makepkg/PKGBUILD.template | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dist/linux/makepkg/PKGBUILD.template b/dist/linux/makepkg/PKGBUILD.template
index de0553d6e..871f4589f 100644
--- a/dist/linux/makepkg/PKGBUILD.template
+++ b/dist/linux/makepkg/PKGBUILD.template
@@ -74,7 +74,7 @@ build() {
     --dest . \
     --name cryptomator \
     --vendor "Skymatic GmbH" \
-    --copyright "(C) 2016 - 2025 Skymatic GmbH" \
+    --copyright "(C) 2016 - 2026 Skymatic GmbH" \
     --java-options "--enable-preview" \
     --java-options '--enable-native-access=javafx.graphics,org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64,org.purejava.appindicator' \
     --java-options "-Xss5m" \

From 2cab0c59a15df3786485d6023be19058fb283b6f Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 20 Feb 2026 16:23:21 +0100
Subject: [PATCH 24/25] update javafx to version 25.0.2

---
 dist/linux/makepkg/PKGBUILD.template | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dist/linux/makepkg/PKGBUILD.template b/dist/linux/makepkg/PKGBUILD.template
index 871f4589f..003ca8c47 100644
--- a/dist/linux/makepkg/PKGBUILD.template
+++ b/dist/linux/makepkg/PKGBUILD.template
@@ -15,7 +15,7 @@ depends=('fuse3' 'alsa-lib' 'hicolor-icon-theme' 'libxtst' 'libnet' 'libxrender'
 makedepends=('maven' 'unzip')
 optdepends=('keepassxc-cryptomator: Use KeePassXC to store vault passwords' 'ttf-hanazono: Install this font when using Japanese system language')
 _jdkver=25.0.2+10
-_jfxver=25
+_jfxver=25.0.2
 _src_app_dir=cryptomator-${pkgver//_/-}
 source=($SOURCES);
 source_x86_64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jdkver:0:2}-binaries/releases/download/jdk-${_jdkver//\+/%2B}/OpenJDK${_jdkver:0:2}U-jdk_x64_linux_hotspot_${_jdkver//\+/_}.tar.gz"
@@ -25,9 +25,9 @@ source_aarch64=("jdk-${_jdkver}.tar.gz::https://github.com/adoptium/temurin${_jd
 noextract=("jdk-${_jdkver}.tar.gz" "openjfx-${_jfxver}.zip")
 sha256sums=($SOURCES_SHA)
 sha256sums_x86_64=('987387933b64b9833846dee373b640440d3e1fd48a04804ec01a6dbf718e8ab8'
-                   '96e520f48610d8ffb94ca30face1f11ffe8a977ddc1c4ff80b1a9e9f048bd94e')
+                   'e0a9c29d8cf3af9b8b48848b43f87b5785bc107c53a951b19668ce05842bba1b')
 sha256sums_aarch64=('a9d73e711d967dc44896d4f430f73a68fd33590dabc29a7f2fb9f593425b854c'
-                    '9ad4ca7b769ca4ee6419f1e99143dd6ff812f8be4fddb46a7d7cacbeea148af4')
+                    'c3408f818693cce09e59829a8e862a82c7695fdfcd585c41cfd527f5fc3fe646')
 options=('!strip')
 
 validpgpkeys=('58117AFA1F85B3EEC154677D615D449FE6E6A235')

From 34eb336e5fb37660cced8f6d58ef1a821bbe5451 Mon Sep 17 00:00:00 2001
From: Armin Schrenk <armin.schrenk@skymatic.de>
Date: Fri, 20 Feb 2026 16:30:22 +0100
Subject: [PATCH 25/25] only commit PKGBUILD and SRCINFO

---
 .github/workflows/linux-makepkg.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index 944d0c854..a79459612 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -166,7 +166,7 @@ jobs:
           git config user.name "cryptobot"
           git config user.email "cryptobot@users.noreply.github.com"
           git config push.autoSetupRemote true
-          git stage .
+          git stage PKGBUILD .SRCINFO
           git commit -m "Prepare release ${VERSION}"
           git push
         env: