[startupfoundry]

The Linux download becomes a prefix that packagers can copy into /usr as is, as ORION suggested on Discord with an AUR package in mind. The game also keeps working when it is just unpacked anywhere, and existing installs move over through the self-updater.

Layout (halo-linux-i686-<config>.zip):

bin/opence
lib/opence/libSDL3.so.0                         rpath $ORIGIN:$ORIGIN/../lib/opence (DT_RPATH kept)
share/opence/brokers.txt
share/applications/opence.desktop               desktop-file-validate passes
share/icons/hicolor/{16..512}/apps/opence.png   from the existing icon art (tools/app_icon.py)
share/doc/opence/                               the READMEs
share/licenses/opence/                          LICENSE.md and the bundled libraries' licences

• bin/opence: the executable takes the project's name instead of /usr/bin/halo. Steam's window class follows the executable name, so it matches the desktop entry. Developer builds are still build/linux/halo.
• Licences: all of them go in share/licenses/opence/, the Arch convention, rather than splitting them with share/doc.

Where the game finds its files (port/linux/src/install_layout.c):

• The game's folder: if the executable is in bin/ with share/opence/ beside it, the folder above bin/ is the game's folder. Otherwise, as today, it is the executable's own folder.
• Portable (unpacked anywhere, or a developer build): config.toml, maps/ and debug.txt stay in that folder, as now.
• Installed: the folder can't be written, or the tree contains an empty share/opence/packaged, which a package adds.
  • Config goes in ~/.config/halo-linux/.
  • Maps, the log and saves go in ~/.local/share/halo-linux/, the save root existing installs already use.
  • The game never updates itself.
  • The marker is a file rather than a build option, so an AUR -bin package can repackage the release zip without rebuilding.
• Windows, Android and the web are unchanged.

Updates and migration.

• The constraint: the updaters already in players' hands ask for halo-linux-<config>.zip and only take a zip's top-level files. Given a tree they fail ("the download is not a zip file this build can read"), so those players could never update again.
• So each release keeps halo-linux-<config>.zip for now: the same build, laid out flat.
  • Old updaters install that as before.
  • The new build runs fine flat.
  • At its next update it asks for halo-linux-i686-<config>.zip and moves the install to the tree. In place of halo it leaves a script that starts bin/opence, so Steam shortcuts keep working.
• The new updater also:
  • refuses entry names that would leave the game's folder;
  • skips links;
  • keeps executable bits;
  • deletes replaced files at the next start (they are listed in update-old.txt).
• For testing without GitHub: debug.update_from (HALO_UPDATE_FROM) updates from a local zip.
• Dropping the flat zip: it can be dropped after a few releases. After that, players who skipped every transition release have to download once by hand.

Packaging.

• tools/linux_package.py is the one place the layout lives. It is used by ci_build.py and the release job; the release job now zips with it because GitHub's artifacts lose the executable bit.
• python tools/linux_package.py tree "$pkgdir/usr" lays out a source build.
• A new "Packaging" section in port/linux/README.md covers what goes where, the packaged marker and the runtime dependencies. A package can leave out lib/opence to use the system's lib32-sdl3.

Test:

• New tests: tools/test_linux_package.py, which also checks that the updater, ci_build.py and the workflow agree on both zip names; tools/test_install_layout.py; and a harness test of the updater's name checks, with negative controls. They pass, as do tools/test_linux_port.py and tools/harness (288).
• tools/ci_build.py linux release built both zips.
• The fresh tree, unpacked, started windowed from bin/opence.
• Migration, run from local zips:
  • An install of the current main release was updated by main's own updater code through the new flat zip.
  • The new build then moved it to the tree.
  • It started from bin/opence and from the halo script.
  • It then updated tree to tree.
  • main's updater was confirmed to fail on the tree zip alone.
• Installed cases: a read-only /usr-style prefix and a writable prefix with the packaged marker both started with nothing written beside the executable and no update attempt.
• Not built here: Windows, Android and the web. Their paths are unchanged, and updater.c was syntax-checked with _WIN32, HALO_ANDROID and HALO_WEB. The workflow changes have not run on GitHub.

[cybersecurity]

Conflicts in seven files, and its updater changes would have to be rewritten on top of the newer rollback and size checks. Please rebase it and then do a split resubmission.