[ronaldtse]

Summary

Adds prebuilt static-library tarballs to GitHub releases, addressing #2443.
Each tarball bundles librnp.a plus a curated static build of every
transitive dependency (sexpp, Botan or OpenSSL, json-c, zlib, bzip2), so
downstream consumers that cannot reach a system package manager (Cargo,
embedded cross-compile targets, Windows app vendors) can link against
librnp without compiling the full C++ + Botan stack from source.

The build runs as a new prebuild matrix job in
.github/workflows/release.yml that depends on the existing release
job, so the source tarball and GitHub release are created first; the
prebuilt tarballs are then uploaded as additional assets to the same
release.

Targets (v1)

[cols="2,1", options="header"]
|===
| Target | Backend(s)
| x86_64-unknown-linux-gnu | botan, openssl
| aarch64-unknown-linux-gnu | botan, openssl
| x86_64-apple-darwin | botan, openssl
| aarch64-apple-darwin | botan, openssl
|===

8 tarballs per release. Windows MSVC (x86_64-pc-windows-msvc) and
Linux musl (x86_64-unknown-linux-musl, aarch64-unknown-linux-musl)
are tracked as follow-up — the script's detect_target already
recognizes them, but the dependency build steps need platform-specific
work that's out of scope for this PR.

What's in each tarball

rnp-v<version>-<target>-<backend>.tar.gz
├── include/
│   ├── rnp/         # public FFI headers (rnp.h, rnp_err.h, rnp_export.h, rnp_ver.h)
│   ├── sexpp/       # sexpp headers
│   ├── botan-3/     # (botan) or openssl/ (openssl)
│   ├── json-c/
│   ├── bzlib.h
│   └── zlib.h
├── lib/
│   ├── librnp.a
│   ├── libsexpp.a
│   ├── libbotan-3.a  # (botan) or libcrypto.a + libssl.a (openssl)
│   ├── libjson-c.a
│   ├── libz.a
│   ├── libbz2.a
│   ├── cmake/rnp/   # find_package(rnp)
│   └── pkgconfig/
└── MANIFEST.txt     # summary, dependency versions, link flags

What changed

ci/build_prebuilt.sh (new)

The static-build orchestrator. Downloads pinned versions of each
dependency, builds them as static libraries into a temporary prefix,
builds librnp against that prefix, and stages the resulting headers and
archives into the tarball layout shown above. Outputs:

• rnp-v<version>-<target>-<backend>.tar.gz
• rnp-v<version>-<target>-<backend>.sha256

Dependency versions are pinned in the script for reproducibility:

• zlib 1.3.1
• bzip2 1.0.8
• json-c 0.19
• Botan 3.10.0 (botan backend)
• OpenSSL 3.6.0 (openssl backend)

ci/botan3-modules, ci/botan3-pqc-modules

Renamed curve25519 to x25519. Botan 3 renamed this module; the
existing files were broken for any Botan 3.x build using them.
ci/botan-modules (used by codeql.yml against Botan 2.17.3) is
unchanged.

.github/workflows/release.yml

Added prebuild matrix job with 8 entries (4 targets x 2 backends).
Each job:

1. Checks out the source at the release tag
2. Installs build deps (Linux/macOS handled separately)
3. Runs ci/build_prebuilt.sh
4. Uploads rnp-*.tar.gz + rnp-*.sha256 to the release via
   gh release upload --clobber

The job depends on release so it only fires after the GitHub release
exists. fail-fast: false ensures one target failing doesn't kill the
others.

docs/packaging.adoc

New "Prebuilt static libraries (release assets)" section documenting
asset naming, available targets, tarball layout, and consumption
patterns (CMake + raw compiler flags). Cross-references the existing
sections on find_package and pkg-config.

Validation

• Validated ci/build_prebuilt.sh end-to-end locally on macOS arm64
  with the botan backend: builds zlib, bzip2, json-c, Botan 3.10.0
  (minimized build with PQC modules), and rnp against the bundled
  stack, stages the tarball, and produces the sha256 sidecar.
• The 8-entry matrix itself can only be exercised by running the
  workflow against a tag; this PR includes the YAML but a real release
  will be the first end-to-end test.

Test plan

• ci/build_prebuilt.sh botan v0.18.1-dev runs to completion on
  macOS arm64 and produces the expected tarball + sha256
• CI green on this branch (workflow syntax check at minimum)
• First tag-triggered run produces all 8 tarballs attached to the
  release

Follow-up work

• Windows MSVC target (x86_64-pc-windows-msvc) — needs vcpkg or
  equivalent for static dep stack on Windows
• Linux musl targets — needs alpine container or musl cross-toolchain
• GPG detached signatures (.asc) for each tarball — the source
  tarball already ships signed; prebuilts should match
• Reproducible builds (currently best-effort via MACOSX_DEPLOYMENT_TARGET
  and pinned dep versions; full reproducibility needs more work on
  glibc symbol versioning and path normalization)

Closes #2443.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.37%. Comparing base (ffa3ad7) to head (0f28c88).
⚠️ Report is 29 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2444   +/-   ##
=======================================
  Coverage   85.36%   85.37%           
=======================================
  Files         126      126           
  Lines       22862    22868    +6     
=======================================
+ Hits        19516    19523    +7     
+ Misses       3346     3345    -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ni4]

LGTM as merge conflicts/CI fixed!

[ronaldtse]

Merging with 1 approval (ni4). CI/release infrastructure — builds and ships prebuilt static-library tarballs as release assets. Thank you @ni4 for the review!