Move mullvad-exclude into suid subpackage

mullvad-vpn-daemon/APKBUILD

@@ -2,7 +2,7 @@
 # Maintainer: Joakim Hulthe <joakim@hulthe.net>
 pkgname=mullvad-vpn-daemon
 pkgver=2026.1_git
-pkgrel=4
+pkgrel=5
 pkgdesc="Mullvad VPN system service"
 url="https://mullvad.net/"
 arch="all"
@@ -24,8 +24,19 @@ makedepends="
 	libnftnl-dev
 "
 checkdepends=""
-install="$pkgname.post-install $pkgname.pre-upgrade $pkgname.post-upgrade $pkgname.pre-deinstall $pkgname.post-deinstall"
-subpackages="$pkgname-systemd"
+install="
+	$pkgname.post-install
+	$pkgname.pre-upgrade
+	$pkgname.post-upgrade
+	$pkgname.pre-deinstall
+	$pkgname.post-deinstall
+ 	$pkgname-systemd.post-install
+	$pkgname-systemd.post-upgrade
+"
+subpackages="
+	$pkgname-systemd
+	$pkgname-suid
+"
 source=""
 builddir="$srcdir/"
 options="net suid"
@@ -44,6 +55,8 @@ build() {
 
 	# Specify `--target` so that the build artifacts ends up in target/<target>/release to
 	# avoid clashes with host system when running in a container with a mounted target folder.
+
+	# Compile all binaries
 	cargo auditable build --release --locked \
 	    --target "$CHOST" \
 	    -p mullvad-cli \
@@ -51,6 +64,12 @@ build() {
 	    -p mullvad-exclude \
 	    -p mullvad-problem-report \
 	    -p mullvad-setup
+
+	# Generate vendored relay list
+	cargo run --release --locked \
+	    -p mullvad-api --bin relay_list \
+	    --target "$CHOST" \
+	    > "$builddir/relays.json"
 }
 
 check() {
@@ -65,15 +84,15 @@ package() {
 	install -m755 -D "$_cargo_target_dir/$CHOST/release/mullvad-daemon" \
 		"$pkgdir"/usr/bin/mullvad-daemon
 
-	# mullvad-exclude requires setuid
-	install -m4755 -D "$_cargo_target_dir/$CHOST/release/mullvad-exclude" \
-		"$pkgdir"/usr/bin/mullvad-exclude
-
 	install -m755 -D "$_cargo_target_dir/$CHOST/release/mullvad-problem-report" \
 		"$pkgdir"/usr/bin/mullvad-problem-report
 
 	install -m755 -D "$_cargo_target_dir/$CHOST/release/mullvad-setup" \
 		"$pkgdir"/usr/bin/mullvad-setup
+
+	# Bundle the vendored relay list. It's copied to /var/cache/mullvad-vpn/ by the post-* scripts.
+	install -m644 -D "$builddir/relays.json" \
+		"$pkgdir"/usr/share/mullvad-vpn/relays.json
 }
 
 systemd() {
@@ -83,3 +102,8 @@ systemd() {
 	install -m755 -D "$startdir/mullvadvpn-app/dist-assets/linux/mullvad-early-boot-blocking.service" \
 		"$subpkgdir"/usr/lib/systemd/system/mullvad-early-boot-blocking.service
 }
+
+suid() {
+	install -m4755 -D "$_cargo_target_dir/$CHOST/release/mullvad-exclude" \
+		"$subpkgdir"/usr/bin/mullvad-exclude
+}

mullvad-vpn-daemon/mullvad-vpn-daemon-systemd.post-install

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -eu
+
+# Are we running systemd?
+if which systemctl &> /dev/null && systemctl is-system-running | grep -vq offline &> /dev/null; then
+    # Does `mullvad-daemon.service` exist?
+    if systemctl list-unit-files mullvad-daemon.service &> /dev/null; then
+      systemctl enable "/usr/lib/systemd/system/mullvad-daemon.service"
+      systemctl start mullvad-daemon.service || echo "Failed to start mullvad-daemon.service"
+      systemctl enable "/usr/lib/systemd/system/mullvad-early-boot-blocking.service"
+    fi
+fi

mullvad-vpn-daemon/mullvad-vpn-daemon-systemd.post-upgrade

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -eu
+
+# Are we running systemd?
+if which systemctl &> /dev/null && systemctl is-system-running | grep -vq offline &> /dev/null; then
+    # Does `mullvad-daemon.service` exist?
+    if systemctl list-unit-files mullvad-daemon.service &> /dev/null; then
+      systemctl enable "/usr/lib/systemd/system/mullvad-daemon.service"
+      systemctl start mullvad-daemon.service || echo "Failed to start mullvad-daemon.service"
+      systemctl enable "/usr/lib/systemd/system/mullvad-early-boot-blocking.service"
+    fi
+fi

mullvad-vpn-daemon/mullvad-vpn-daemon.post-install

@@ -1,10 +1,7 @@
 #!/usr/bin/env bash
 set -eu
 
-if which systemctl &> /dev/null && systemctl is-system-running | grep -vq offline &> /dev/null; then
-    if systemctl status mullvad-daemon &> /dev/null; then
-      systemctl enable "/usr/lib/systemd/system/mullvad-daemon.service"
-      systemctl start mullvad-daemon.service || echo "Failed to start mullvad-daemon.service"
-      systemctl enable "/usr/lib/systemd/system/mullvad-early-boot-blocking.service"
-    fi
-fi
+# Overwrite the cached relay list with the one embedded in the package.
+mkdir -p /var/cache/mullvad-vpn \
+  && cp /usr/share/mullvad-vpn/relays.json /var/cache/mullvad-vpn/relays.json \
+  || echo "failed to install /var/cache/mullvad-vpn/relays.json"

mullvad-vpn-daemon/mullvad-vpn-daemon.post-upgrade

@@ -1,10 +1,6 @@
 #!/usr/bin/env bash
 set -eu
 
-if which systemctl &> /dev/null && systemctl is-system-running | grep -vq offline &> /dev/null; then
-    if systemctl status mullvad-daemon &> /dev/null; then
-      systemctl enable "/usr/lib/systemd/system/mullvad-daemon.service"
-      systemctl start mullvad-daemon.service || echo "Failed to start mullvad-daemon.service"
-      systemctl enable "/usr/lib/systemd/system/mullvad-early-boot-blocking.service"
-    fi
-fi
+# Overwrite the cached relay list with the one embedded in the package.
+mkdir /var/cache/mullvad-vpn
+cp /usr/share/mullvad-vpn/relays.json /var/cache/mullvad-vpn/relays.json

mullvad-vpn-daemon/mullvad-vpn-daemon.pre-deinstall

@@ -1,18 +1,6 @@
 #!/usr/bin/env bash
 set -eu
 
-echo "Running prerm."
-is_number_re='^[0-9]+$'
-# Check if we're running during an upgrade step on Fedora
-# https://fedoraproject.org/wiki/Packaging:Scriptlets#Syntax
-if [[ "$1" =~ $is_number_re ]] && [ "$1" -gt 0 ]; then
-    exit 0;
-fi
-
-if [[ "$1" == "upgrade" ]]; then
-    exit 0;
-fi
-
 # the user might've disabled or stopped the service themselves already
 systemctl stop mullvad-daemon.service || true
 systemctl disable mullvad-daemon.service || true

mullvad-vpn-daemon/mullvad-vpn-daemon.pre-upgrade

@@ -1,7 +1,9 @@
 #!/usr/bin/env bash
 set -eu
 
+# Are we running systemd?
 if which systemctl &> /dev/null && systemctl is-system-running | grep -vq offline &> /dev/null; then
+    # Is `mullvad-daemon.service` running?
     if systemctl status mullvad-daemon &> /dev/null; then
         mullvad-setup prepare-restart || true
         systemctl stop mullvad-daemon.service
@@ -12,5 +14,5 @@ if which systemctl &> /dev/null && systemctl is-system-running | grep -vq offlin
     fi
 fi
 
-rm -f /var/cache/mullvad-vpn/relays.json
+# Since we are upgrading mullvad-daemon, it will probably have current IP baked into itself.
 rm -f /var/cache/mullvad-vpn/api-ip-address.txt