From 51f264bca2cca3627587cc6c987a0b3a3ca3c524 Mon Sep 17 00:00:00 2001
From: m1ngsama <contact@m1ng.space>
Date: Thu, 28 May 2026 09:09:02 +0800
Subject: [PATCH] Add package system user metadata

---
 docs/CHANGELOG.md                |  2 ++
 packaging/arch/.SRCINFO          |  2 ++
 packaging/arch/PKGBUILD          |  8 ++++++--
 packaging/arch/tnt-chat.sysusers |  1 +
 packaging/debian/README.md       |  2 ++
 packaging/debian/debian/control  |  3 ++-
 packaging/debian/debian/postinst | 10 ++++++++++
 scripts/release_check.sh         | 12 ++++++++++++
 8 files changed, 37 insertions(+), 3 deletions(-)
 create mode 100644 packaging/arch/tnt-chat.sysusers
 create mode 100755 packaging/debian/debian/postinst

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 8e4f63a..84171f4 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -109,6 +109,8 @@
   instead of being rejected locally.
 - `tntctl` local help and local validation errors now follow `TNT_LANG` and
   locale selection, matching the server CLI's i18n behavior.
+- Arch and Debian packaging drafts now create the `tnt` system user used by
+  the packaged systemd unit, and release preflight checks that metadata.
 - Split UI-language parsing from localized text lookup: `src/i18n.c` now owns
   locale/code parsing, while `src/i18n_text.c` owns the table-driven text
   catalog with coverage checks for every message ID.
diff --git a/packaging/arch/.SRCINFO b/packaging/arch/.SRCINFO
index 1c7bcb6..981cea4 100644
--- a/packaging/arch/.SRCINFO
+++ b/packaging/arch/.SRCINFO
@@ -10,6 +10,8 @@ pkgbase = tnt-chat
 	makedepends = make
 	depends = libssh
 	source = tnt-chat-1.0.1.tar.gz::https://github.com/m1ngsama/TNT/archive/refs/tags/v1.0.1.tar.gz
+	source = tnt-chat.sysusers
 	sha256sums = SKIP
+	sha256sums = 8a1f7dfbdc9f1305c4ed50d80e89f91333ffdf937890c497f93e41abaf76e3ed
 
 pkgname = tnt-chat
diff --git a/packaging/arch/PKGBUILD b/packaging/arch/PKGBUILD
index 1c1c1ab..f3bf187 100644
--- a/packaging/arch/PKGBUILD
+++ b/packaging/arch/PKGBUILD
@@ -9,8 +9,10 @@ url='https://github.com/m1ngsama/TNT'
 license=('MIT')
 depends=('libssh')
 makedepends=('gcc' 'make')
-source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('SKIP')
+source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
+        "${pkgname}.sysusers")
+sha256sums=('SKIP'
+            '8a1f7dfbdc9f1305c4ed50d80e89f91333ffdf937890c497f93e41abaf76e3ed')
 
 build() {
   cd "TNT-${pkgver}"
@@ -21,5 +23,7 @@ package() {
   cd "TNT-${pkgver}"
   make DESTDIR="${pkgdir}" PREFIX=/usr install
   make DESTDIR="${pkgdir}" PREFIX=/usr install-systemd
+  install -Dm644 "${srcdir}/${pkgname}.sysusers" \
+    "${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
   install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }
diff --git a/packaging/arch/tnt-chat.sysusers b/packaging/arch/tnt-chat.sysusers
new file mode 100644
index 0000000..3040c61
--- /dev/null
+++ b/packaging/arch/tnt-chat.sysusers
@@ -0,0 +1 @@
+u tnt - "TNT chat server" /var/lib/tnt -
diff --git a/packaging/debian/README.md b/packaging/debian/README.md
index 377cc30..0e4e82e 100644
--- a/packaging/debian/README.md
+++ b/packaging/debian/README.md
@@ -47,3 +47,5 @@ debuild -S
 - Installed commands: `/usr/bin/tnt`, `/usr/bin/tntctl`
 - Runtime dependency: `libssh`
 - Optional systemd unit: `/usr/lib/systemd/system/tnt.service`
+- System user: package maintainer scripts create `tnt:tnt`; the systemd unit
+  owns `/var/lib/tnt` through `StateDirectory=tnt`
diff --git a/packaging/debian/debian/control b/packaging/debian/debian/control
index d1c28fb..317c4ea 100644
--- a/packaging/debian/debian/control
+++ b/packaging/debian/debian/control
@@ -15,7 +15,8 @@ Package: tnt-chat
 Architecture: any
 Depends:
  ${misc:Depends},
- ${shlibs:Depends}
+ ${shlibs:Depends},
+ adduser
 Description: SSH-native terminal chat server
  TNT is a minimalist terminal chat server accessed over SSH. It provides a
  Vim-style terminal interface, anonymous access by default, persistent message
diff --git a/packaging/debian/debian/postinst b/packaging/debian/debian/postinst
new file mode 100755
index 0000000..d7cf2c1
--- /dev/null
+++ b/packaging/debian/debian/postinst
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -e
+
+if [ "$1" = "configure" ] && ! getent passwd tnt >/dev/null; then
+    adduser --system --group --home /var/lib/tnt --no-create-home --gecos "TNT chat server" tnt
+fi
+
+#DEBHELPER#
+
+exit 0
diff --git a/scripts/release_check.sh b/scripts/release_check.sh
index aa8c0c8..d0ed501 100755
--- a/scripts/release_check.sh
+++ b/scripts/release_check.sh
@@ -164,8 +164,20 @@ sh -n install.sh
 step "checking Debian packaging metadata"
 [ -x packaging/debian/debian/rules ] ||
     fail "packaging/debian/debian/rules must be executable"
+[ -x packaging/debian/debian/postinst ] ||
+    fail "packaging/debian/debian/postinst must be executable"
 grep -q "^3.0 (quilt)$" packaging/debian/debian/source/format ||
     fail "unsupported Debian source format"
+grep -q "adduser .* tnt" packaging/debian/debian/postinst ||
+    fail "Debian postinst must create the tnt system user"
+grep -q " adduser" packaging/debian/debian/control ||
+    fail "Debian package must depend on adduser for postinst user creation"
+
+step "checking packaged system user metadata"
+grep -q '^u tnt ' packaging/arch/tnt-chat.sysusers ||
+    fail "Arch sysusers file must create the tnt system user"
+grep -q 'usr/lib/sysusers.d' packaging/arch/PKGBUILD ||
+    fail "PKGBUILD must install the sysusers.d file"
 
 step "checking packaging syntax"
 if command -v bash >/dev/null 2>&1; then