Update daemon to 2026.3-beta1 and make scripts less "presumptous"

mullvad-vpn-daemon/APKBUILD

@@ -1,7 +1,7 @@
 maintainer="Joakim Hulthe <joakim@hulthe.net>"
 pkgname=mullvad-vpn-daemon
-pkgver=2026.2_beta1
+pkgver=2026.3_beta1
-pkgrel=0
+pkgrel=2
 pkgdesc="Mullvad VPN client (daemon and CLI)"
 url="https://mullvad.net/"
 # Mullvad depends on old versions of the `nix` library
@@ -67,14 +67,11 @@ package() {
 		"$_cargo_release_dir/mullvad-problem-report" \
 		"$_cargo_release_dir/mullvad-setup"		
 
-	# TODO: Bundle a relay list.
+	# Bundle the relay list.
-	# We can't generate one at build time since that would break build reproducibility.
+	install -m644 -D "$builddir/dist-assets/relays/relays.json" \
-	# Once mullvad starts checking a relay list into their release branches, we can bundle that.
+		"$pkgdir/usr/share/mullvad-vpn/relays.json"
-	#install -m644 -D "$builddir/<todo>/relays.json" \
-	#	"$pkgdir/usr/share/mullvad-vpn/relays.json"
-	# TODO: Copy relay list into /var/cache/ in post-upgrade/post-install
 
-	# files in /usr/lib/systemd/ are automatically put in systemd subpackage
+	# Files in /usr/lib/systemd/ are automatically put in systemd subpackage
 	install -m755 -Dt "$pkgdir/usr/lib/systemd/system/" \
 		"$builddir/dist-assets/linux/mullvad-daemon.service" \
 		"$builddir/dist-assets/linux/mullvad-early-boot-blocking.service"
@@ -89,5 +86,5 @@ suid() {
 }
 
 sha512sums="
-9af0c263f0e5985d7842099f50a5070da0b23691f08ffe57c3b6d239d2c1c9acea89c07890f31d89bd75448a2dd1fd3c878b85be458baba0bcd90760e714b032  2026.2-beta1.tar.gz
+7766ad0401cd42a43c272726bd600e70d29a95f4f9b5192cc906e6e7008139a403fb6128a00940ea1306c0446f8af4a43d2f3fd89c6cd81a730be9db8ae50f82  2026.3-beta1.tar.gz
 "

mullvad-vpn-daemon/mullvad-vpn-daemon-systemd.post-install

@@ -1,9 +1,8 @@
 #!/bin/sh
 set -eu
 
-# Enable and start systemd services
+echo '>>> To start Mullvad VPN, enable the daemon:'
-if which systemctl >/dev/null 2>&1 && systemctl is-system-running | grep -vq offline >/dev/null 2>&1; then
+echo '    systemctl enable --now mullvad-daemon.service'
-  systemctl enable "/usr/lib/systemd/system/mullvad-daemon.service"
+echo ''
-  systemctl start mullvad-daemon.service || echo "Failed to start mullvad-daemon.service"
+echo '>>> Optional: block network until VPN is up at boot:'
-  systemctl enable "/usr/lib/systemd/system/mullvad-early-boot-blocking.service"
+echo '    systemctl enable mullvad-early-boot-blocking.service'
-fi

mullvad-vpn-daemon/mullvad-vpn-daemon-systemd.post-upgrade

@@ -1,9 +1,6 @@
 #!/bin/sh
 set -eu
 
-# Enable and start systemd services
+# Mark systemd service for restart
-if which systemctl >/dev/null 2>&1 && systemctl is-system-running | grep -vq offline >/dev/null 2>&1; then
+systemctl set-property mullvad-daemon.service Markers=+needs-restart \
-  systemctl enable "/usr/lib/systemd/system/mullvad-daemon.service"
+  || echo "Failed to mark mullvad-daemon for restart"
-  systemctl start mullvad-daemon.service || echo "Failed to start mullvad-daemon.service"
-  systemctl enable "/usr/lib/systemd/system/mullvad-early-boot-blocking.service"
-fi

mullvad-vpn-daemon/mullvad-vpn-daemon-systemd.pre-deinstall

@@ -1,8 +0,0 @@
-#!/bin/sh
-set -eu
-
-# Stop and disable all mullvad services
-systemctl stop mullvad-daemon.service || true
-systemctl disable mullvad-daemon.service || true
-systemctl stop mullvad-early-boot-blocking.service || true
-systemctl disable mullvad-early-boot-blocking.service || true

mullvad-vpn-daemon/mullvad-vpn-daemon.post-install

@@ -1,8 +1,7 @@
 #!/bin/sh
 set -eu
 
-# TODO: see `package()` in APKBUILD
 # Copy vendored relay list into place
-# mkdir -p /var/cache/mullvad-vpn \
+mkdir -p /var/cache/mullvad-vpn \
-#   && cp /usr/share/mullvad-vpn/relays.json /var/cache/mullvad-vpn/relays.json \
+  && cp /usr/share/mullvad-vpn/relays.json /var/cache/mullvad-vpn/relays.json \
-#   || echo "failed to install /var/cache/mullvad-vpn/relays.json"
+  || echo "failed to install /var/cache/mullvad-vpn/relays.json"

mullvad-vpn-daemon/mullvad-vpn-daemon.post-upgrade

@@ -1,8 +1,8 @@
 #!/bin/sh
 set -eu
 
-# TODO: see `package()` in APKBUILD
 # Overwrite the cached relay list with the vendored one.
-# mkdir -p /var/cache/mullvad-vpn \
+# The new daemon should contain an up-to-date list.
-#   && cp /usr/share/mullvad-vpn/relays.json /var/cache/mullvad-vpn/relays.json \
+mkdir -p /var/cache/mullvad-vpn \
-#   || echo "failed to install /var/cache/mullvad-vpn/relays.json"
+  && cp /usr/share/mullvad-vpn/relays.json /var/cache/mullvad-vpn/relays.json \
+  || echo "failed to install /var/cache/mullvad-vpn/relays.json"

mullvad-vpn-daemon/mullvad-vpn-daemon.pre-deinstall

@@ -1,6 +0,0 @@
-#!/bin/sh
-set -eu
-
-# Log out and remove any firewall rules
-mullvad-setup reset-firewall || echo "Failed to reset firewall"
-mullvad-setup remove-device || echo "Failed to remove device from account"

mullvad-vpn-daemon/mullvad-vpn-daemon.pre-upgrade

@@ -1,18 +1,6 @@
 #!/bin/sh
 set -eu
 
-# Stop the daemon gracefully, and set up firewall rules to prevent network
-# leaks during upgrade.
-if which systemctl >/dev/null 2>&1 && systemctl is-system-running | grep -vq offline >/dev/null 2>&1; then
-    if systemctl status mullvad-daemon >/dev/null 2>&1; then
-        mullvad-setup prepare-restart || true
-        systemctl stop mullvad-daemon.service
-        systemctl disable mullvad-daemon.service
-        systemctl disable mullvad-early-boot-blocking.service || true
-        cp /var/log/mullvad-vpn/daemon.log /var/log/mullvad-vpn/old-install-daemon.log \
-            || echo "Failed to copy old daemon log"
-    fi
-fi
-
 # Clear the cached API IP address.
+# The new daemon should contain an up-to-date address.
 rm -f /var/cache/mullvad-vpn/api-ip-address.txt