Validate staged FreeBSD binaries before packaging

Check that deckcraft and deckcraft-cli are 64-bit little-endian FreeBSD ELF files
for the selected arch before the archive is created, so placeholder, wrong-arch
or non-FreeBSD binaries fail instead of being packaged. Applies to --skip-build
and full builds.

packaging/freebsd/package.sh

@@ -14,17 +14,47 @@ set -euo pipefail
 LINUX="$ROOT/packaging/linux"
 APP_ID=ai.storyteller.deckcraft
 
-if [[ "${1:-}" != "--skip-build" ]]; then
-  (cd "$ROOT" && cargo build --release --locked -p deckcraft -p deckcraft-cli)
+TARGET_ARGS=()
+BIN="$CARGO_TARGET_DIR/release"
+if [[ -n "${CARGO_BUILD_TARGET:-}" ]]; then
+  # host-tuple means the build host; resolve it so the target dir path is a real triple.
+  if [[ "$CARGO_BUILD_TARGET" == host-tuple ]]; then
+    CARGO_BUILD_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+  fi
+  # The target triple, not the build host's uname, names the arch of a cross build.
+  case "$CARGO_BUILD_TARGET" in
+    x86_64-unknown-freebsd) ARCH=x86_64 ;;
+    aarch64-unknown-freebsd) ARCH=aarch64 ;;
+    *) echo "error: unsupported CARGO_BUILD_TARGET '$CARGO_BUILD_TARGET' (expected x86_64-unknown-freebsd or aarch64-unknown-freebsd)" >&2; exit 1 ;;
+  esac
+  TARGET_ARGS=(--target "$CARGO_BUILD_TARGET")
+  BIN="$CARGO_TARGET_DIR/$CARGO_BUILD_TARGET/release"
+else
+  ARCH="$(uname -m)"
+  case "$ARCH" in
+    amd64) ARCH=x86_64 ;;
+    arm64) ARCH=aarch64 ;;
+    *) ;;
+  esac
 fi
 
-ARCH="$(uname -m)"
+if [[ "${1:-}" != "--skip-build" ]]; then
+  (cd "$ROOT" && cargo build --release --locked "${TARGET_ARGS[@]}" -p deckcraft -p deckcraft-cli)
+fi
+
+# Refuse placeholder, wrong-arch or non-FreeBSD binaries (also with --skip-build). Bytes: ELF magic,
+# 64-bit little-endian, OSABI SYSV or FreeBSD, e_machine.
 case "$ARCH" in
-  amd64) ARCH=x86_64 ;;
-  arm64) ARCH=aarch64 ;;
-  *) ;;
+  x86_64) MACHINE=" 3e 00" ;;
+  aarch64) MACHINE=" b7 00" ;;
+  *) echo "error: no ELF machine check for arch '$ARCH'" >&2; exit 1 ;;
 esac
-BIN="$CARGO_TARGET_DIR/release"
+for f in "$BIN/deckcraft" "$BIN/deckcraft-cli"; do
+  [[ "$(od -An -tx1 -N6 "$f" 2>/dev/null)" == " 7f 45 4c 46 02 01" ]] || { echo "error: $f is not a 64-bit little-endian ELF" >&2; exit 1; }
+  [[ "$(od -An -tx1 -j7 -N1 "$f")" =~ ^\ (00|09)$ ]] || { echo "error: $f is not a FreeBSD ELF (OSABI)" >&2; exit 1; }
+  [[ "$(od -An -tx1 -j18 -N2 "$f")" == "$MACHINE" ]] || { echo "error: $f is not an ELF for $ARCH" >&2; exit 1; }
+done
+
 NAME="deckcraft-$VERSION-freebsd-$ARCH"
 WORK="$CARGO_TARGET_DIR/freebsd-package"
 STAGE="$WORK/$NAME"
@@ -41,6 +71,6 @@ cp -R "$ROOT/assets/app-icon/hicolor" "$STAGE/share/icons/"
 copy_docs "$STAGE/share/doc/deckcraft"
 
 tar -C "$WORK" -czf "$DIST/$NAME.tar.gz" "$NAME"
-"$STAGE/bin/deckcraft-cli" --version
+if [[ -z "${CARGO_BUILD_TARGET:-}" || "$CARGO_BUILD_TARGET" == "$(rustc -vV | sed -n 's/^host: //p')" ]]; then "$STAGE/bin/deckcraft-cli" --version; fi # a cross-built binary cannot run on the build host
 echo "wrote $DIST/$NAME.tar.gz"
 ls -lh "$DIST/$NAME.tar.gz"

packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml

@@ -31,9 +31,9 @@ finish-args:
   # document portal, so picked files work anywhere without broad filesystem access. Documents is
   # granted so decks passed by path (the command line, Open Recent) work in the usual place.
   - --filesystem=xdg-documents
-  # Deliberately not granted: network (the optional --control server listens on 127.0.0.1 in
-  # the sandbox; `flatpak override --user --share=network ai.storyteller.deckcraft` exposes it to
-  # host agents) and home/host filesystem access.
+  # Network: update checks reach GitHub. The optional --control server still listens on 127.0.0.1
+  # only. Home/host filesystem access is deliberately not granted.
+  - --share=network
 modules:
   - name: deckcraft
     buildsystem: simple

packaging/linux/flatpak/ai.storyteller.deckcraft.yml

@@ -32,9 +32,9 @@ finish-args:
   # document portal, so picked files work anywhere without broad filesystem access. Documents is
   # granted so decks passed by path (the command line, Open Recent) work in the usual place.
   - --filesystem=xdg-documents
-  # Deliberately not granted: network (the optional --control server listens on 127.0.0.1 in
-  # the sandbox; `flatpak override --user --share=network ai.storyteller.deckcraft` exposes it to
-  # host agents) and home/host filesystem access.
+  # Network: update checks reach GitHub. The optional --control server still listens on 127.0.0.1
+  # only. Home/host filesystem access is deliberately not granted.
+  - --share=network
 build-options:
   append-path: /usr/lib/sdk/rust-stable/bin
 modules: