fix(v12): Create tombstone event on room upgrade

fix: V12 room upgrades
chore(deps): update ghcr.io/renovatebot/renovate docker tag to v41.127.2
2026-05-26 20:49:55 +00:00 · 2025-09-24 18:22:16 +00:00 · 2025-09-24 18:22:16 +00:00 · 2025-09-24 05:03:46 +00:00 · 2025-09-23 22:16:46 +01:00 · 2025-09-23 22:15:01 +01:00
34 changed files with 1047 additions and 685 deletions
@@ -61,14 +61,16 @@ runs:
      id: meta
      uses: docker/metadata-action@v5
      with:
+        flavor: |
+          suffix=${{ inputs.tag_suffix }},onlatest=true
        tags: |
-          type=semver,pattern={{version}},prefix=v,suffix=${{ inputs.tag_suffix }}
-          type=semver,pattern={{major}}.{{minor}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.0.') }},prefix=v,suffix=${{ inputs.tag_suffix }}
-          type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }},prefix=v,suffix=${{ inputs.tag_suffix }}
-          type=ref,event=branch,prefix=${{ format('refs/heads/{0}', github.event.repository.default_branch) != github.ref && 'branch-' || '' }},suffix=${{ inputs.tag_suffix }}
-          type=ref,event=pr,suffix=${{ inputs.tag_suffix }}
-          type=sha,format=short,suffix=${{ inputs.tag_suffix }}
-          type=raw,value=latest${{ inputs.tag_suffix }},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+          type=semver,pattern={{version}},prefix=v
+          type=semver,pattern={{major}}.{{minor}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.0.') }},prefix=v
+          type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }},prefix=v
+          type=ref,event=branch,prefix=${{ format('refs/heads/{0}', github.event.repository.default_branch) != github.ref && 'branch-' || '' }},
+          type=ref,event=pr
+          type=sha,format=short
+          type=raw,value=latest${{ inputs.tag_suffix }},enable=${{ startsWith(github.ref, 'refs/tags/v') }},priority=1100
        images: ${{ inputs.images }}
        # default labels & annotations: https://github.com/docker/metadata-action/blob/master/src/meta.ts#L509
      env:
@@ -81,6 +83,7 @@ runs:
      env:
        IMAGES: ${{ inputs.images }}
      run: |
+        set -o xtrace
        IFS=$'\n'
        IMAGES_LIST=($IMAGES)
        ANNOTATIONS_LIST=($DOCKER_METADATA_OUTPUT_ANNOTATIONS)
@@ -98,6 +101,7 @@ runs:
      env:
        IMAGES: ${{ inputs.images }}
      run: |
+        set -o xtrace
        IMAGES_LIST=($IMAGES)
        for REPO in "${IMAGES_LIST[@]}"; do
          docker buildx imagetools inspect $REPO:${{ steps.meta.outputs.version }}
@@ -1,58 +0,0 @@
-name: detect-runner-os
-description: |
-  Detect the actual OS name and version of the runner.
-  Provides separate outputs for name, version, and a combined slug.
-
-outputs:
-  name:
-    description: 'OS name (e.g. Ubuntu, Debian)'
-    value: ${{ steps.detect.outputs.name }}
-  version:
-    description: 'OS version (e.g. 22.04, 11)'
-    value: ${{ steps.detect.outputs.version }}
-  slug:
-    description: 'Combined OS slug (e.g. Ubuntu-22.04)'
-    value: ${{ steps.detect.outputs.slug }}
-  node_major:
-    description: 'Major version of Node.js if available (e.g. 22)'
-    value: ${{ steps.detect.outputs.node_major }}
-  node_version:
-    description: 'Full Node.js version if available (e.g. 22.19.0)'
-    value: ${{ steps.detect.outputs.node_version }}
-
-runs:
-  using: composite
-  steps:
-    - name: Detect runner OS
-      id: detect
-      shell: bash
-      run: |
-        # Detect OS version (try lsb_release first, fall back to /etc/os-release)
-        OS_VERSION=$(lsb_release -rs 2>/dev/null || grep VERSION_ID /etc/os-release | cut -d'"' -f2)
-
-        # Detect OS name and capitalise (try lsb_release first, fall back to /etc/os-release)
-        OS_NAME=$(lsb_release -is 2>/dev/null || grep "^ID=" /etc/os-release | cut -d'=' -f2 | tr -d '"' | sed 's/\b\(.\)/\u\1/g')
-
-        # Create combined slug
-        OS_SLUG="${OS_NAME}-${OS_VERSION}"
-
-        # Detect Node.js version if available
-        if command -v node >/dev/null 2>&1; then
-          NODE_VERSION=$(node --version | sed 's/v//')
-          NODE_MAJOR=$(echo $NODE_VERSION | cut -d. -f1)
-          echo "node_version=${NODE_VERSION}" >> $GITHUB_OUTPUT
-          echo "node_major=${NODE_MAJOR}" >> $GITHUB_OUTPUT
-          echo "🔍 Detected Node.js: v${NODE_VERSION}"
-        else
-          echo "node_version=" >> $GITHUB_OUTPUT
-          echo "node_major=" >> $GITHUB_OUTPUT
-          echo "🔍 Node.js not found"
-        fi
-
-        # Set OS outputs
-        echo "name=${OS_NAME}" >> $GITHUB_OUTPUT
-        echo "version=${OS_VERSION}" >> $GITHUB_OUTPUT
-        echo "slug=${OS_SLUG}" >> $GITHUB_OUTPUT
-
-        # Log detection results
-        echo "🔍 Detected Runner OS: ${OS_NAME} ${OS_VERSION}"
@@ -121,7 +121,7 @@ runs:
          .cargo/git/checkouts
          .cargo/registry
          .cargo/registry/src
-        key: rust-registry-image-${{hashFiles('**/Cargo.lock') }}
+        key: continuwuity-rust-registry-image-${{hashFiles('**/Cargo.lock') }}

    - name: Cache cargo target
      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
@@ -130,7 +130,7 @@ runs:
      with:
        path: |
          cargo-target${{ env.CPU_SUFFIX }}-${{ inputs.slug }}-${{ inputs.profile }}
-        key: cargo-target${{ env.CPU_SUFFIX }}-${{ inputs.slug }}-${{ inputs.profile }}-${{hashFiles('**/Cargo.lock') }}-${{steps.rust-toolchain.outputs.rustc_version}}
+        key: continuwuity-cargo-target${{ env.CPU_SUFFIX }}-${{ inputs.slug }}-${{ inputs.profile }}-${{hashFiles('**/Cargo.lock') }}-${{steps.rust-toolchain.outputs.rustc_version}}

    - name: Cache apt cache
      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
@@ -139,7 +139,7 @@ runs:
      with:
        path: |
          var-cache-apt-${{ inputs.slug }}
-        key: var-cache-apt-${{ inputs.slug }}
+        key: continuwuity-var-cache-apt-${{ inputs.slug }}

    - name: Cache apt lib
      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
@@ -148,7 +148,7 @@ runs:
      with:
        path: |
          var-lib-apt-${{ inputs.slug }}
-        key: var-lib-apt-${{ inputs.slug }}
+        key: continuwuity-var-lib-apt-${{ inputs.slug }}

    - name: inject cache into docker
      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
@@ -40,7 +40,7 @@ runs:
          !~/.rustup/tmp
          !~/.rustup/downloads
        # Requires repo to be cloned if toolchain is not specified
-        key: ${{ runner.os }}-rustup-${{ inputs.toolchain || hashFiles('**/rust-toolchain.toml') }}
+        key: continuwuity-${{ runner.os }}-rustup-${{ inputs.toolchain || hashFiles('**/rust-toolchain.toml') }}
    - name: Install Rust toolchain
      if: steps.rustup-version.outputs.version == ''
      shell: bash
@@ -29,7 +29,7 @@ runs:
  steps:
    - name: Detect runner OS
      id: runner-os
-      uses: ./.forgejo/actions/detect-runner-os
+      uses: https://git.tomfos.tr/actions/detect-versions@v1

    - name: Configure cross-compilation architecture
      if: inputs.dpkg-arch != ''
@@ -69,7 +69,7 @@ runs:
          /usr/lib/x86_64-linux-gnu/libclang*.so*
          /etc/apt/sources.list.d/archive_uri-*
          /etc/apt/trusted.gpg.d/apt.llvm.org.asc
-        key: llvm-${{ steps.runner-os.outputs.slug }}-v${{ inputs.llvm-version }}-v3-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }}
+        key: continuwuity-llvm-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-v${{ inputs.llvm-version }}-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }}

    - name: End LLVM cache group
      shell: bash
@@ -39,7 +39,7 @@ runs:
  steps:
    - name: Detect runner OS
      id: runner-os
-      uses: ./.forgejo/actions/detect-runner-os
+      uses: https://git.tomfos.tr/actions/detect-versions@v1

    - name: Configure Cargo environment
      shell: bash
@@ -73,9 +73,9 @@ runs:
          .cargo/git/db
        # Registry cache saved per workflow, restored from any workflow's cache
        # Each workflow maintains its own registry that accumulates its needed crates
-        key: cargo-registry-${{ steps.runner-os.outputs.slug }}-${{ github.workflow }}
+        key: continuwuity-cargo-registry-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-${{ github.workflow }}
        restore-keys: |
-          cargo-registry-${{ steps.runner-os.outputs.slug }}-
+          continuwuity-cargo-registry-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-

    - name: Cache toolchain binaries
      id: toolchain-cache
@@ -86,29 +86,42 @@ runs:
          .rustup/toolchains
          .rustup/update-hashes
        # Shared toolchain cache across all Rust versions
-        key: toolchain-${{ steps.runner-os.outputs.slug }}
+        key: continuwuity-toolchain-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}


    - name: Setup sccache
      uses: https://git.tomfos.tr/tom/sccache-action@v1

-    - name: Cache build artifacts
-      id: build-cache
+    - name: Cache dependencies
+      id: deps-cache
      uses: actions/cache@v4
      with:
        path: |
-          target/**/deps
-          !target/**/deps/*.rlib
-          target/**/build
          target/**/.fingerprint
-          target/**/incremental
+          target/**/deps
          target/**/*.d
+          target/**/.cargo-lock
+          target/**/CACHEDIR.TAG
+          target/**/.rustc_info.json
          /timelord/
-        # Build artifacts - cache per code change, restore from deps when code changes
+        # Dependencies cache - based on Cargo.lock, survives source code changes
        key: >-
-          build-${{ steps.runner-os.outputs.slug }}-${{ inputs.rust-version }}${{ inputs.cache-key-suffix && format('-{0}', inputs.cache-key-suffix) || '' }}-${{ hashFiles('rust-toolchain.toml', '**/Cargo.lock') }}-${{ hashFiles('**/*.rs', '**/Cargo.toml') }}
+          continuwuity-deps-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-${{ inputs.rust-version }}${{ inputs.cache-key-suffix && format('-{0}', inputs.cache-key-suffix) || '' }}-${{ hashFiles('rust-toolchain.toml', '**/Cargo.lock') }}
        restore-keys: |
-          build-${{ steps.runner-os.outputs.slug }}-${{ inputs.rust-version }}${{ inputs.cache-key-suffix && format('-{0}', inputs.cache-key-suffix) || '' }}-${{ hashFiles('rust-toolchain.toml', '**/Cargo.lock') }}-
+          continuwuity-deps-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-${{ inputs.rust-version }}${{ inputs.cache-key-suffix && format('-{0}', inputs.cache-key-suffix) || '' }}-
+
+    - name: Cache incremental compilation
+      id: incremental-cache
+      uses: actions/cache@v4
+      with:
+        path: |
+          target/**/incremental
+        # Incremental cache - based on source code changes
+        key: >-
+          continuwuity-incremental-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-${{ inputs.rust-version }}${{ inputs.cache-key-suffix && format('-{0}', inputs.cache-key-suffix) || '' }}-${{ hashFiles('rust-toolchain.toml', '**/Cargo.lock') }}-${{ hashFiles('**/*.rs', '**/Cargo.toml') }}
+        restore-keys: |
+          continuwuity-incremental-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-${{ inputs.rust-version }}${{ inputs.cache-key-suffix && format('-{0}', inputs.cache-key-suffix) || '' }}-${{ hashFiles('rust-toolchain.toml', '**/Cargo.lock') }}-
+          continuwuity-incremental-${{ steps.runner-os.outputs.slug }}-${{ steps.runner-os.outputs.arch }}-${{ inputs.rust-version }}${{ inputs.cache-key-suffix && format('-{0}', inputs.cache-key-suffix) || '' }}-

    - name: End cache restore group
      shell: bash
@@ -36,7 +36,7 @@ runs:
        path: |
          /usr/share/rust/.cargo/bin
          ~/.cargo/bin
-        key: timelord-binaries-v3
+        key: continuwuity-timelord-binaries

    - name: Check if binaries need installation
      shell: bash
@@ -82,7 +82,7 @@ runs:
        path: |
          /usr/share/rust/.cargo/bin
          ~/.cargo/bin
-        key: timelord-binaries-v3
+        key: continuwuity-timelord-binaries


    - name: Restore timelord cache with fallbacks
@@ -92,7 +92,7 @@ runs:
        path: ${{ env.TIMELORD_CACHE_PATH }}
        key: ${{ env.TIMELORD_KEY }}
        restore-keys: |
-          timelord-v1-${{ github.repository }}-
+          continuwuity-timelord-${{ github.repository }}-

    - name: Initialize timestamps on complete cache miss
      if: steps.timelord-restore.outputs.cache-hit != 'true'
@@ -0,0 +1,148 @@
+name: Build / Debian DEB
+
+concurrency:
+  group: "build-debian-${{ forge.ref }}"
+  cancel-in-progress: true
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+  schedule:
+    - cron: '30 0 * * *'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        container: ["ubuntu-latest", "ubuntu-previous", "debian-latest", "debian-oldstable"]
+    container:
+      image: "ghcr.io/tcpipuk/act-runner:${{ matrix.container }}"
+
+    steps:
+      - name: Get Debian version
+        id: debian-version
+        run: |
+          VERSION=$(cat /etc/debian_version)
+          DISTRIBUTION=$(lsb_release -sc 2>/dev/null)
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "distribution=$DISTRIBUTION" >> $GITHUB_OUTPUT
+          echo "Debian distribution: $DISTRIBUTION ($VERSION)"
+
+      - name: Checkout repository with full history
+        uses: https://code.forgejo.org/actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Cache Cargo registry
+        uses: https://code.forgejo.org/actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: cargo-debian-${{ steps.debian-version.outputs.distribution }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-debian-${{ steps.debian-version.outputs.distribution }}-
+
+      - name: Setup sccache
+        uses: https://git.tomfos.tr/tom/sccache-action@v1
+
+      - name: Configure sccache environment
+        run: |
+          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
+          echo "CMAKE_C_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+          echo "CMAKE_CXX_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+          echo "SCCACHE_CACHE_SIZE=10G" >> $GITHUB_ENV
+          # Aggressive GC since cache restores don't increment counter
+          echo "CARGO_INCREMENTAL_GC_TRIGGER=5" >> $GITHUB_ENV
+
+      - name: Setup Rust nightly
+        uses: ./.forgejo/actions/setup-rust
+        with:
+          rust-version: nightly
+          github-token: ${{ secrets.GH_PUBLIC_RO }}
+
+      - name: Get package version and component
+        id: package-meta
+        run: |
+          BASE_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r ".packages[] | select(.name == \"conduwuit\").version" | sed 's/[^a-zA-Z0-9.+]/~/g')
+          # VERSION is the package version, COMPONENT is used in
+          # apt's repository config like a git repo branch
+          if [[ "${{ forge.ref }}" == "refs/tags/"* ]]; then
+            # Use the "stable" component for tagged releases
+            COMPONENT="stable"
+            VERSION=$BASE_VERSION
+          else
+            # Use the "dev" component for development builds
+            SHA=$(echo "${{ forge.sha }}" | cut -c1-7)
+            DATE=$(date +%Y%m%d)
+            if [ "${{ forge.ref_name }}" = "main" ]; then
+              COMPONENT="dev"
+            else
+              # Use the sanitized ref name as the component for feature branches
+              COMPONENT="dev-$(echo '${{ forge.ref_name }}' | sed 's/[^a-zA-Z0-9.+]/-/g' | tr '[:upper:]' '[:lower:]' | cut -c1-30)"
+            fi
+            CLEAN_COMPONENT=$(echo $COMPONENT | sed 's/[^a-zA-Z0-9.+]/~/g')
+            VERSION="$BASE_VERSION~git$DATE.$SHA-$CLEAN_COMPONENT"
+          fi
+          echo "component=$COMPONENT" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Component: $COMPONENT"
+          echo "Version: $VERSION"
+
+      - name: Install cargo-deb
+        run: |
+          if command -v cargo-deb &> /dev/null; then
+            echo "cargo-deb already available"
+          else
+            echo "Installing cargo-deb"
+            cargo-binstall -y --no-symlinks cargo-deb
+          fi
+
+      - name: Install build dependencies
+        run: |
+          apt-get update -y
+          # Build dependencies for rocksdb
+          apt-get install -y clang liburing-dev
+
+      - name: Run cargo-deb
+        id: cargo-deb
+        run: |
+          DEB_PATH=$(cargo deb --deb-version ${{ steps.package-meta.outputs.version }})
+          echo "path=$DEB_PATH" >> $GITHUB_OUTPUT
+
+      - name: Test deb installation
+        run: |
+          echo "Installing: ${{ steps.cargo-deb.outputs.path }}"
+
+          apt-get install -y ${{ steps.cargo-deb.outputs.path }}
+
+          dpkg -s continuwuity
+
+          [ -f /usr/bin/conduwuit ] && echo "✅ Binary installed successfully"
+          [ -f /usr/lib/systemd/system/conduwuit.service ] && echo "✅ Systemd service installed"
+          [ -f /etc/conduwuit/conduwuit.toml ] && echo "✅ Config file installed"
+
+      - name: Upload deb artifact
+        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        with:
+          name: continuwuity-${{ steps.debian-version.outputs.distribution }}
+          path: ${{ steps.cargo-deb.outputs.path }}
+
+      - name: Publish to Forgejo package registry
+        if: ${{ forge.event_name == 'push' || forge.event_name == 'workflow_dispatch' }}
+        run: |
+          OWNER="continuwuation"
+          DISTRIBUTION=${{ steps.debian-version.outputs.distribution }}
+          COMPONENT=${{ steps.package-meta.outputs.component }}
+          DEB=${{ steps.cargo-deb.outputs.path }}
+
+          echo "Publishing: $DEB in component $COMPONENT for distribution $DISTRIBUTION"
+
+          curl --fail-with-body \
+            -X PUT \
+            -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+            --upload-file "$DEB" \
+            "${{ forge.server_url }}/api/packages/$OWNER/debian/pool/$DISTRIBUTION/$COMPONENT/upload"
@@ -0,0 +1,389 @@
+name: Build / Fedora RPM
+
+concurrency:
+  group: "build-fedora-${{ github.ref }}"
+  cancel-in-progress: true
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+    # paths:
+    #   - 'pkg/fedora/**'
+    #   - 'src/**'
+    #   - 'Cargo.toml'
+    #   - 'Cargo.lock'
+    #   - '.forgejo/workflows/build-fedora.yml'
+  workflow_dispatch:
+  schedule:
+    - cron: '30 0 * * *'
+
+jobs:
+  build:
+    runs-on: fedora-latest
+    steps:
+      - name: Detect Fedora version
+        id: fedora
+        run: |
+          VERSION=$(rpm -E %fedora)
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Fedora version: $VERSION"
+
+      - name: Checkout repository with full history
+        uses: https://code.forgejo.org/actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+
+      - name: Cache DNF packages
+        uses: https://code.forgejo.org/actions/cache@v4
+        with:
+          path: |
+            /var/cache/dnf
+            /var/cache/yum
+          key: dnf-fedora${{ steps.fedora.outputs.version }}-${{ hashFiles('pkg/fedora/continuwuity.spec.rpkg') }}-v1
+          restore-keys: |
+            dnf-fedora${{ steps.fedora.outputs.version }}-
+
+      - name: Cache Cargo registry
+        uses: https://code.forgejo.org/actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: cargo-fedora${{ steps.fedora.outputs.version }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-fedora${{ steps.fedora.outputs.version }}-
+
+      - name: Cache Rust build dependencies
+        uses: https://code.forgejo.org/actions/cache@v4
+        with:
+          path: |
+            ~/rpmbuild/BUILD/*/target/release/deps
+            ~/rpmbuild/BUILD/*/target/release/build
+            ~/rpmbuild/BUILD/*/target/release/.fingerprint
+            ~/rpmbuild/BUILD/*/target/release/incremental
+          key: rust-deps-fedora${{ steps.fedora.outputs.version }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            rust-deps-fedora${{ steps.fedora.outputs.version }}-
+
+      - name: Setup sccache
+        uses: https://git.tomfos.tr/tom/sccache-action@v1
+
+      - name: Configure sccache environment
+        run: |
+          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
+          echo "CMAKE_C_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+          echo "CMAKE_CXX_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+          echo "SCCACHE_CACHE_SIZE=10G" >> $GITHUB_ENV
+          # Aggressive GC since cache restores don't increment counter
+          echo "CARGO_INCREMENTAL_GC_TRIGGER=5" >> $GITHUB_ENV
+
+      - name: Install base RPM tools
+        run: |
+          dnf install -y --setopt=keepcache=1 \
+            fedora-packager \
+            python3-pip \
+            rpm-sign \
+            rpkg \
+            wget
+
+      - name: Setup build environment and build SRPM
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git config --global user.email "ci@continuwuity.org"
+          git config --global user.name "Continuwuity"
+
+          rpmdev-setuptree
+
+          cd "$GITHUB_WORKSPACE"
+
+          # Determine release suffix and version based on ref type and branch
+          if [[ "${{ github.ref }}" == "refs/tags/"* ]]; then
+            # Tags get clean version numbers for stable releases
+            RELEASE_SUFFIX=""
+            TAG_NAME="${{ github.ref_name }}"
+            # Extract version from tag (remove v prefix if present)
+            TAG_VERSION=$(echo "$TAG_NAME" | sed 's/^v//')
+
+            # Create spec file with tag version
+            sed -e "s/^Version:.*$/Version:        $TAG_VERSION/" \
+                -e "s/^Release:.*$/Release:        1%{?dist}/" \
+                pkg/fedora/continuwuity.spec.rpkg > continuwuity.spec.rpkg
+          elif [ "${{ github.ref_name }}" = "main" ]; then
+            # Main branch gets .dev suffix
+            RELEASE_SUFFIX=".dev"
+
+            # Replace the Release line to include our suffix
+            sed "s/^Release:.*$/Release:        1${RELEASE_SUFFIX}%{?dist}/" \
+              pkg/fedora/continuwuity.spec.rpkg > continuwuity.spec.rpkg
+          else
+            # Other branches get sanitized branch name as suffix
+            SAFE_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[^a-zA-Z0-9]/_/g' | cut -c1-20)
+            RELEASE_SUFFIX=".${SAFE_BRANCH}"
+
+            # Replace the Release line to include our suffix
+            sed "s/^Release:.*$/Release:        1${RELEASE_SUFFIX}%{?dist}/" \
+              pkg/fedora/continuwuity.spec.rpkg > continuwuity.spec.rpkg
+          fi
+
+          rpkg srpm --outdir "$HOME/rpmbuild/SRPMS"
+
+          ls -la $HOME/rpmbuild/SRPMS/
+
+
+      - name: Install build dependencies from SRPM
+        run: |
+          SRPM=$(find "$HOME/rpmbuild/SRPMS" -name "*.src.rpm" | head -1)
+
+          if [ -z "$SRPM" ]; then
+            echo "Error: No SRPM file found"
+            exit 1
+          fi
+
+          echo "Installing build dependencies from: $(basename $SRPM)"
+          dnf builddep -y "$SRPM"
+
+      - name: Build RPM from SRPM
+        run: |
+          SRPM=$(find "$HOME/rpmbuild/SRPMS" -name "*.src.rpm" | head -1)
+
+          if [ -z "$SRPM" ]; then
+            echo "Error: No SRPM file found"
+            exit 1
+          fi
+
+          echo "Building from SRPM: $SRPM"
+
+          rpmbuild --rebuild "$SRPM" \
+            --define "_topdir $HOME/rpmbuild" \
+            --define "_sourcedir $GITHUB_WORKSPACE" \
+            --nocheck  # Skip %check section to avoid test dependencies
+
+
+      - name: Test RPM installation
+        run: |
+          # Find the main binary RPM (exclude debug and source RPMs)
+          RPM=$(find "$HOME/rpmbuild/RPMS" -name "continuwuity-*.rpm" \
+            ! -name "*debuginfo*" \
+            ! -name "*debugsource*" \
+            ! -name "*.src.rpm" | head -1)
+
+          if [ -z "$RPM" ]; then
+            echo "Error: No binary RPM file found"
+            exit 1
+          fi
+
+          echo "Testing installation of: $RPM"
+
+          # Dry run first
+          rpm -qpi "$RPM"
+          echo ""
+          rpm -qpl "$RPM"
+
+          # Actually install it
+          dnf install -y "$RPM"
+
+          # Verify installation
+          rpm -qa | grep continuwuity
+
+          # Check that the binary exists
+          [ -f /usr/bin/conduwuit ] && echo "✅ Binary installed successfully"
+          [ -f /usr/lib/systemd/system/conduwuit.service ] && echo "✅ Systemd service installed"
+          [ -f /etc/conduwuit/conduwuit.toml ] && echo "✅ Config file installed"
+
+      - name: List built packages
+        run: |
+          echo "Binary RPMs:"
+          find "$HOME/rpmbuild/RPMS" -name "*.rpm" -type f -exec ls -la {} \;
+
+          echo ""
+          echo "Source RPMs:"
+          find "$HOME/rpmbuild/SRPMS" -name "*.rpm" -type f -exec ls -la {} \;
+
+      - name: Collect artifacts
+        run: |
+          mkdir -p artifacts
+
+          find "$HOME/rpmbuild/RPMS" -name "*.rpm" -type f -exec cp {} artifacts/ \;
+          find "$HOME/rpmbuild/SRPMS" -name "*.rpm" -type f -exec cp {} artifacts/ \;
+
+          cd artifacts
+          echo "Build Information:" > BUILD_INFO.txt
+          echo "==================" >> BUILD_INFO.txt
+          echo "Git commit: ${{ github.sha }}" >> BUILD_INFO.txt
+          echo "Git branch: ${{ github.ref_name }}" >> BUILD_INFO.txt
+          echo "Build date: $(date -u +%Y-%m-%d_%H:%M:%S_UTC)" >> BUILD_INFO.txt
+          echo "" >> BUILD_INFO.txt
+          echo "Package contents:" >> BUILD_INFO.txt
+          echo "-----------------" >> BUILD_INFO.txt
+          for rpm in *.rpm; do
+            echo "" >> BUILD_INFO.txt
+            echo "File: $rpm" >> BUILD_INFO.txt
+            rpm -qpi "$rpm" 2>/dev/null | grep -E "^(Name|Version|Release|Architecture|Size)" >> BUILD_INFO.txt
+          done
+
+          ls -la
+
+      - name: Upload binary RPM artifact
+        run: |
+          # Find the main binary RPM (exclude debug and source RPMs)
+          BIN_RPM=$(find artifacts -name "continuwuity-*.rpm" \
+            ! -name "*debuginfo*" \
+            ! -name "*debugsource*" \
+            ! -name "*.src.rpm" \
+            -type f)
+
+          mkdir -p upload-bin
+          cp $BIN_RPM upload-bin/
+
+      - name: Upload binary RPM
+        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        with:
+          name: continuwuity
+          path: upload-bin/
+
+      - name: Upload debug RPM artifact
+        uses: https://code.forgejo.org/actions/upload-artifact@v3
+        with:
+          name: continuwuity-debug
+          path: artifacts/*debuginfo*.rpm
+
+      - name: Publish to RPM Package Registry
+        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
+        run: |
+          # Find the main binary RPM (exclude debug and source RPMs)
+          RPM=$(find artifacts -name "continuwuity-*.rpm" \
+            ! -name "*debuginfo*" \
+            ! -name "*debugsource*" \
+            ! -name "*.src.rpm" \
+            -type f | head -1)
+
+          if [ -z "$RPM" ]; then
+            echo "No binary RPM found to publish"
+            exit 0
+          fi
+
+          RPM_BASENAME=$(basename "$RPM")
+          echo "Publishing: $RPM_BASENAME"
+
+          # Determine the group based on ref type and branch
+          if [[ "${{ github.ref }}" == "refs/tags/"* ]]; then
+            GROUP="stable"
+            # For tags, extract the tag name for version info
+            TAG_NAME="${{ github.ref_name }}"
+          elif [ "${{ github.ref_name }}" = "main" ]; then
+            GROUP="dev"
+          else
+            # Use sanitized branch name as group for feature branches
+            GROUP=$(echo "${{ github.ref_name }}" | sed 's/[^a-zA-Z0-9]/-/g' | tr '[:upper:]' '[:lower:]' | cut -c1-30)
+          fi
+
+          PACKAGE_INFO=$(rpm -qpi "$RPM" 2>/dev/null)
+          PACKAGE_NAME=$(echo "$PACKAGE_INFO" | grep "^Name" | awk '{print $3}')
+          PACKAGE_VERSION=$(echo "$PACKAGE_INFO" | grep "^Version" | awk '{print $3}')
+          PACKAGE_RELEASE=$(echo "$PACKAGE_INFO" | grep "^Release" | awk '{print $3}')
+          PACKAGE_ARCH=$(echo "$PACKAGE_INFO" | grep "^Architecture" | awk '{print $2}')
+
+          # Full version includes release
+          FULL_VERSION="${PACKAGE_VERSION}-${PACKAGE_RELEASE}"
+
+          # Forgejo's RPM registry cannot overwrite existing packages, so we must delete first
+          # 404 is OK if package doesn't exist yet
+          echo "Removing any existing package: $PACKAGE_NAME-$FULL_VERSION.$PACKAGE_ARCH"
+          RESPONSE=$(curl -s -w "\n%{http_code}" -X DELETE \
+            -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+            "https://forgejo.ellis.link/api/packages/continuwuation/rpm/$GROUP/package/$PACKAGE_NAME/$FULL_VERSION/$PACKAGE_ARCH")
+          HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
+
+          if [ "$HTTP_CODE" != "204" ] && [ "$HTTP_CODE" != "404" ]; then
+            echo "ERROR: Failed to delete package (HTTP $HTTP_CODE)"
+            echo "$RESPONSE" | head -n -1
+            exit 1
+          fi
+
+          curl --fail-with-body \
+            -X PUT \
+            -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+            -H "Content-Type: application/x-rpm" \
+            -T "$RPM" \
+            "https://forgejo.ellis.link/api/packages/continuwuation/rpm/$GROUP/upload?sign=true"
+
+          echo ""
+          echo "✅ Published binary RPM to: https://forgejo.ellis.link/continuwuation/-/packages/rpm/continuwuity/"
+          echo "Group: $GROUP"
+
+          # Upload debug RPMs to separate group
+          DEBUG_RPMS=$(find artifacts -name "*debuginfo*.rpm")
+          if [ -n "$DEBUG_RPMS" ]; then
+            echo ""
+            echo "Publishing debug RPMs to group: ${GROUP}-debug"
+
+            for DEBUG_RPM in $DEBUG_RPMS; do
+              echo "Publishing: $(basename "$DEBUG_RPM")"
+
+              DEBUG_INFO=$(rpm -qpi "$DEBUG_RPM" 2>/dev/null)
+              DEBUG_NAME=$(echo "$DEBUG_INFO" | grep "^Name" | awk '{print $3}')
+              DEBUG_VERSION=$(echo "$DEBUG_INFO" | grep "^Version" | awk '{print $3}')
+              DEBUG_RELEASE=$(echo "$DEBUG_INFO" | grep "^Release" | awk '{print $3}')
+              DEBUG_ARCH=$(echo "$DEBUG_INFO" | grep "^Architecture" | awk '{print $2}')
+              DEBUG_FULL_VERSION="${DEBUG_VERSION}-${DEBUG_RELEASE}"
+
+              # Must delete existing package first (Forgejo limitation)
+              RESPONSE=$(curl -s -w "\n%{http_code}" -X DELETE \
+                -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+                "https://forgejo.ellis.link/api/packages/continuwuation/rpm/${GROUP}-debug/package/$DEBUG_NAME/$DEBUG_FULL_VERSION/$DEBUG_ARCH")
+              HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
+
+              if [ "$HTTP_CODE" != "204" ] && [ "$HTTP_CODE" != "404" ]; then
+                echo "ERROR: Failed to delete debug package (HTTP $HTTP_CODE)"
+                echo "$RESPONSE" | head -n -1
+                exit 1
+              fi
+
+              curl --fail-with-body \
+                -X PUT \
+                -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+                -H "Content-Type: application/x-rpm" \
+                -T "$DEBUG_RPM" \
+                "https://forgejo.ellis.link/api/packages/continuwuation/rpm/${GROUP}-debug/upload?sign=true"
+            done
+
+            echo "✅ Published debug RPMs to group: ${GROUP}-debug"
+          fi
+
+          # Also upload the SRPM to separate group
+          SRPM=$(find artifacts -name "*.src.rpm" | head -1)
+          if [ -n "$SRPM" ]; then
+            echo ""
+            echo "Publishing source RPM: $(basename "$SRPM")"
+            echo "Publishing to group: ${GROUP}-src"
+
+            SRPM_INFO=$(rpm -qpi "$SRPM" 2>/dev/null)
+            SRPM_NAME=$(echo "$SRPM_INFO" | grep "^Name" | awk '{print $3}')
+            SRPM_VERSION=$(echo "$SRPM_INFO" | grep "^Version" | awk '{print $3}')
+            SRPM_RELEASE=$(echo "$SRPM_INFO" | grep "^Release" | awk '{print $3}')
+            SRPM_FULL_VERSION="${SRPM_VERSION}-${SRPM_RELEASE}"
+
+            # Must delete existing SRPM first (Forgejo limitation)
+            echo "Removing any existing SRPM: $SRPM_NAME-$SRPM_FULL_VERSION.src"
+            RESPONSE=$(curl -s -w "\n%{http_code}" -X DELETE \
+              -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+              "https://forgejo.ellis.link/api/packages/continuwuation/rpm/${GROUP}-src/package/$SRPM_NAME/$SRPM_FULL_VERSION/src")
+            HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
+
+            if [ "$HTTP_CODE" != "204" ] && [ "$HTTP_CODE" != "404" ]; then
+              echo "ERROR: Failed to delete SRPM (HTTP $HTTP_CODE)"
+              echo "$RESPONSE" | head -n -1
+              exit 1
+            fi
+
+            curl --fail-with-body \
+              -X PUT \
+              -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+              -H "Content-Type: application/x-rpm" \
+              -T "$SRPM" \
+              "https://forgejo.ellis.link/api/packages/continuwuation/rpm/${GROUP}-src/upload?sign=true"
+
+            echo "✅ Published source RPM to group: ${GROUP}-src"
+          fi
@@ -51,7 +51,7 @@ jobs:

      - name: Detect runner environment
        id: runner-env
-        uses: ./.forgejo/actions/detect-runner-os
+        uses: https://git.tomfos.tr/actions/detect-versions@v1

      - name: Setup Node.js
        if: steps.runner-env.outputs.node_major == '' || steps.runner-env.outputs.node_major < '20'
@@ -63,9 +63,7 @@ jobs:
        uses: actions/cache@v3
        with:
          path: ~/.npm
-          key: ${{ steps.runner-env.outputs.slug }}-node-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ steps.runner-env.outputs.slug }}-node-
+          key: continuwuity-${{ steps.runner-env.outputs.slug }}-${{ steps.runner-env.outputs.arch }}-node-${{ steps.runner-env.outputs.node_version }}

      - name: Install dependencies
        run: npm install --save-dev wrangler@latest
@@ -43,7 +43,7 @@ jobs:
    name: Renovate
    runs-on: ubuntu-latest
    container:
-      image: ghcr.io/renovatebot/renovate:41.121.4@sha256:c3348a8cc65f3519ec3412d3b9787dc2ae151052220f87f533bfdded051227a9
+      image: ghcr.io/renovatebot/renovate:41.127.2@sha256:66bc84e2f889025fbb3c9df863500dcc18bc64ac85bcf629d015064377d77f31
      options: --tmpfs /tmp:exec
    steps:
      - name: Checkout
@@ -59,27 +59,27 @@ jobs:
        with:
          path: |
            /tmp/renovate/cache/renovate/repository
-          key: repo-cache-${{ github.run_id }}
+          key: renovate-repo-cache-${{ github.run_id }}
          restore-keys: |
-            repo-cache-
+            renovate-repo-cache-

      - name: Restore renovate package cache
        uses: actions/cache/restore@v4
        with:
          path: |
            /tmp/renovate/cache/renovate/renovate-cache-sqlite
-          key: package-cache-${{ github.run_id }}
+          key: renovate-package-cache-${{ github.run_id }}
          restore-keys: |
-            package-cache-
+            renovate-package-cache-

      - name: Restore renovate OSV cache
        uses: actions/cache/restore@v4
        with:
          path: |
            /tmp/osv
-          key: osv-cache-${{ github.run_id }}
+          key: renovate-osv-cache-${{ github.run_id }}
          restore-keys: |
-            osv-cache-
+            renovate-osv-cache-

      - name: Self-hosted Renovate
        run: renovate
@@ -113,7 +113,7 @@ jobs:
        with:
          path: |
            /tmp/renovate/cache/renovate/repository
-          key: repo-cache-${{ github.run_id }}
+          key: renovate-repo-cache-${{ github.run_id }}

      - name: Save renovate package cache
        if: always()
@@ -121,7 +121,7 @@ jobs:
        with:
          path: |
            /tmp/renovate/cache/renovate/renovate-cache-sqlite
-          key: package-cache-${{ github.run_id }}
+          key: renovate-package-cache-${{ github.run_id }}

      - name: Save renovate OSV cache
        if: always()
@@ -129,4 +129,4 @@ jobs:
        with:
          path: |
            /tmp/osv
-          key: osv-cache-${{ github.run_id }}
+          key: renovate-osv-cache-${{ github.run_id }}
@@ -20,7 +20,7 @@ jobs:
          submodules: false
          persist-credentials: false

-      - uses: https://github.com/cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31.6.1
+      - uses: https://github.com/cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31.6.2
        with:
          nix_path: nixpkgs=channel:nixos-unstable

@@ -875,7 +875,7 @@ dependencies = [

 [[package]]
 name = "conduwuit"
-version = "0.5.0-rc.8.1"
+version = "0.5.0-rc.8"
 dependencies = [
 "clap",
 "conduwuit_admin",
@@ -907,7 +907,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_admin"
-version = "0.5.0-rc.8.1"
+version = "0.5.0-rc.8"
 dependencies = [
 "clap",
 "conduwuit_api",
@@ -929,7 +929,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_api"
-version = "0.5.0-rc.8.1"
+version = "0.5.0-rc.8"
 dependencies = [
 "async-trait",
 "axum",
@@ -962,14 +962,14 @@ dependencies = [

 [[package]]
 name = "conduwuit_build_metadata"
-version = "0.5.0-rc.8.1"
+version = "0.5.0-rc.8"
 dependencies = [
 "built 0.8.0",
 ]

 [[package]]
 name = "conduwuit_core"
-version = "0.5.0-rc.8.1"
+version = "0.5.0-rc.8"
 dependencies = [
 "argon2",
 "arrayvec",
@@ -1030,7 +1030,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_database"
-version = "0.5.0-rc.8.1"
+version = "0.5.0-rc.8"
 dependencies = [
 "async-channel",
 "conduwuit_core",
@@ -1049,7 +1049,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_macros"
-version = "0.5.0-rc.8.1"
+version = "0.5.0-rc.8"
 dependencies = [
 "itertools 0.14.0",
 "proc-macro2",
@@ -1059,7 +1059,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_router"
-version = "0.5.0-rc.8.1"
+version = "0.5.0-rc.8"
 dependencies = [
 "axum",
 "axum-client-ip",
@@ -1094,7 +1094,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_service"
-version = "0.5.0-rc.8.1"
+version = "0.5.0-rc.8"
 dependencies = [
 "async-trait",
 "base64 0.22.1",
@@ -1134,7 +1134,7 @@ dependencies = [

 [[package]]
 name = "conduwuit_web"
-version = "0.5.0-rc.8.1"
+version = "0.5.0-rc.8"
 dependencies = [
 "askama",
 "axum",
@@ -6565,7 +6565,7 @@ dependencies = [

 [[package]]
 name = "xtask"
-version = "0.5.0-rc.8.1"
+version = "0.5.0-rc.8"
 dependencies = [
 "clap",
 "serde",
@@ -6574,7 +6574,7 @@ dependencies = [

 [[package]]
 name = "xtask-generate-commands"
-version = "0.5.0-rc.8.1"
+version = "0.5.0-rc.8"
 dependencies = [
 "clap-markdown",
 "clap_builder",
@@ -21,7 +21,7 @@ license = "Apache-2.0"
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
 rust-version = "1.86.0"
-version = "0.5.0-rc.8.1"
+version = "0.5.0-rc.8"

 [workspace.metadata.crane]
 name = "conduwuit"
@@ -166,7 +166,7 @@ ARG RUST_PROFILE=release
 # Build the binary
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git/db \
-    --mount=type=cache,target=/app/target,id=cargo-target-${TARGET_CPU}-${TARGETPLATFORM}-${RUST_PROFILE} \
+    --mount=type=cache,target=/app/target,id=continuwuity-cargo-target-${TARGET_CPU}-${TARGETPLATFORM}-${RUST_PROFILE} \
    bash <<'EOF'
    set -o allexport
    set -o xtrace
@@ -122,7 +122,7 @@ ARG RUST_PROFILE=release
 # Build the binary
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git/db \
-    --mount=type=cache,target=/app/target,id=cargo-target-${TARGET_CPU}-${TARGETPLATFORM}-musl-${RUST_PROFILE} \
+    --mount=type=cache,target=/app/target,id=continuwuity-cargo-target-${TARGET_CPU}-${TARGETPLATFORM}-musl-${RUST_PROFILE} \
    bash <<'EOF'
    set -o allexport
    set -o xtrace
@@ -10,6 +10,7 @@
  - [Kubernetes](deploying/kubernetes.md)
  - [Arch Linux](deploying/arch-linux.md)
  - [Debian](deploying/debian.md)
+  - [Fedora](deploying/fedora.md)
  - [FreeBSD](deploying/freebsd.md)
 - [TURN](turn.md)
 - [Appservices](appservices.md)
@@ -0,0 +1,201 @@
+# RPM Installation Guide
+
+Continuwuity is available as RPM packages for Fedora, RHEL, and compatible distributions.
+
+The RPM packaging files are maintained in the `fedora/` directory:
+- `continuwuity.spec.rpkg` - RPM spec file using rpkg macros for building from git
+- `continuwuity.service` - Systemd service file for the server
+- `RPM-GPG-KEY-continuwuity.asc` - GPG public key for verifying signed packages
+
+RPM packages built by CI are signed with our GPG key (Ed25519, ID: `5E0FF73F411AAFCA`).
+
+```bash
+# Import the signing key
+sudo rpm --import https://forgejo.ellis.link/continuwuation/continuwuity/raw/branch/main/fedora/RPM-GPG-KEY-continuwuity.asc
+
+# Verify a downloaded package
+rpm --checksig continuwuity-*.rpm
+```
+
+## Installation methods
+
+**Stable releases** (recommended)
+
+```bash
+# Add the repository and install
+sudo dnf config-manager addrepo --from-repofile=https://forgejo.ellis.link/api/packages/continuwuation/rpm/stable/continuwuation.repo
+sudo dnf install continuwuity
+```
+
+**Development builds** from main branch
+
+```bash
+# Add the dev repository and install
+sudo dnf config-manager addrepo --from-repofile=https://forgejo.ellis.link/api/packages/continuwuation/rpm/dev/continuwuation.repo
+sudo dnf install continuwuity
+```
+
+**Feature branch builds** (example: `tom/new-feature`)
+
+```bash
+# Branch names are sanitized (slashes become hyphens, lowercase only)
+sudo dnf config-manager addrepo --from-repofile=https://forgejo.ellis.link/api/packages/continuwuation/rpm/tom-new-feature/continuwuation.repo
+sudo dnf install continuwuity
+```
+
+**Direct installation** without adding repository
+
+```bash
+# Latest stable release
+sudo dnf install https://forgejo.ellis.link/api/packages/continuwuation/rpm/stable/continuwuity
+
+# Latest development build
+sudo dnf install https://forgejo.ellis.link/api/packages/continuwuation/rpm/dev/continuwuity
+
+# Specific feature branch
+sudo dnf install https://forgejo.ellis.link/api/packages/continuwuation/rpm/branch-name/continuwuity
+```
+
+**Manual repository configuration** (alternative method)
+
+```bash
+cat << 'EOF' | sudo tee /etc/yum.repos.d/continuwuity.repo
+[continuwuity]
+name=Continuwuity - Matrix homeserver
+baseurl=https://forgejo.ellis.link/api/packages/continuwuation/rpm/stable
+enabled=1
+gpgcheck=1
+gpgkey=https://forgejo.ellis.link/continuwuation/continuwuity/raw/branch/main/fedora/RPM-GPG-KEY-continuwuity.asc
+EOF
+
+sudo dnf install continuwuity
+```
+
+## Package management
+
+**Automatic updates** with DNF Automatic
+
+```bash
+# Install and configure
+sudo dnf install dnf-automatic
+sudo nano /etc/dnf/automatic.conf  # Set: apply_updates = yes
+sudo systemctl enable --now dnf-automatic.timer
+```
+
+**Manual updates**
+
+```bash
+# Check for updates
+sudo dnf check-update continuwuity
+
+# Update to latest version
+sudo dnf update continuwuity
+```
+
+**Switching channels** (stable/dev/feature branches)
+
+```bash
+# List enabled repositories
+dnf repolist | grep continuwuation
+
+# Disable current repository
+sudo dnf config-manager --set-disabled continuwuation-stable  # or -dev, or branch name
+
+# Enable desired repository
+sudo dnf config-manager --set-enabled continuwuation-dev  # or -stable, or branch name
+
+# Update to the new channel's version
+sudo dnf update continuwuity
+```
+
+**Verifying installation**
+
+```bash
+# Check installed version
+rpm -q continuwuity
+
+# View package information
+rpm -qi continuwuity
+
+# List installed files
+rpm -ql continuwuity
+
+# Verify package integrity
+rpm -V continuwuity
+```
+
+## Service management and removal
+
+**Systemd service commands**
+
+```bash
+# Start the service
+sudo systemctl start conduwuit
+
+# Enable on boot
+sudo systemctl enable conduwuit
+
+# Check status
+sudo systemctl status conduwuit
+
+# View logs
+sudo journalctl -u conduwuit -f
+```
+
+**Uninstallation**
+
+```bash
+# Stop and disable the service
+sudo systemctl stop conduwuit
+sudo systemctl disable conduwuit
+
+# Remove the package
+sudo dnf remove continuwuity
+
+# Remove the repository (optional)
+sudo rm /etc/yum.repos.d/continuwuation-*.repo
+```
+
+## Troubleshooting
+
+**GPG key errors**: Temporarily disable GPG checking
+
+```bash
+sudo dnf --nogpgcheck install continuwuity
+```
+
+**Repository metadata issues**: Clear and rebuild cache
+
+```bash
+sudo dnf clean all
+sudo dnf makecache
+```
+
+**Finding specific versions**
+
+```bash
+# List all available versions
+dnf --showduplicates list continuwuity
+
+# Install a specific version
+sudo dnf install continuwuity-<version>
+```
+
+## Building locally
+
+Build the RPM locally using rpkg:
+
+```bash
+# Install dependencies
+sudo dnf install rpkg rpm-build cargo-rpm-macros systemd-rpm-macros
+
+# Clone the repository
+git clone https://forgejo.ellis.link/continuwuation/continuwuity.git
+cd continuwuity
+
+# Build SRPM
+rpkg srpm
+
+# Build RPM
+rpmbuild --rebuild *.src.rpm
+```
@@ -8,10 +8,6 @@
        {
            "id": 3,
            "message": "_taps microphone_ The Continuwuity 0.5.0-rc.7 release is now available, and it's better than ever! **177 commits**, **35 pull requests**, **11 contributors,** and a lot of new stuff!\n\nFor highlights, we've got:\n\n* 🕵️ Full Policy Server support to fight spam!\n* 🚀 Smarter room & space upgrades.\n* 🚫 User suspension tools for better moderation.\n* 🤖 reCaptcha support for safer open registration.\n* 🔍 Ability to disable read receipts & typing indicators.\n* ⚡ Sweeping performance improvements!\n\nGet the [full changelog and downloads on our Forgejo](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v0.5.0-rc.7) - and make sure you're in the [Announcements room](https://matrix.to/#/!releases:continuwuity.org/$hN9z6L2_dTAlPxFLAoXVfo_g8DyYXu4cpvWsSrWhmB0) to get stuff like this sooner."
-        },
-        {
-            "id": 5,
-            "message": "It's a bird! It's a plane! No, it's 0.5.0-rc.8.1!\n\nThis is a minor bugfix update to the rc8 which backports some important fixes from the latest main branch. If you still haven't updated to rc8, you should skip to main. Otherwise, you should upgrade to this bugfix release as soon as possible.\n\nBugfixes backported to this version:\n\n- Resolved several issues with state resolution v2.1 (room version 12)\n- Fixed issues with the `restricted` and `knock_restricted` join rules that would sometimes incorrectly disallow a valid join\n- Fixed the automatic support contact listing being a no-op\n- Fixed upgrading pre-v12 rooms to v12 rooms\n- Fixed policy servers sending the incorrect JSON objects (resulted in false positives)\n- Fixed debug build panic during MSC4133 migration\n\nIt is recommended, if you can and are comfortable with doing so, following updates to the main branch - we're in the run up to the full 0.5.0 release, and more and more bugfixes and new features are being pushed constantly. Please don't forget to join [#announcements:continuwuity.org](https://matrix.to/#/#announcements:continuwuity.org) to receive this news faster and be alerted to other important updates!"
        }
    ]
 }
@@ -65,10 +65,10 @@
                    domain = "forgejo.ellis.link";
                    owner = "continuwuation";
                    repo = "rocksdb";
-                    rev = "10.4.fb";
-                    sha256 = "sha256-/Hvy1yTH/0D5aa7bc+/uqFugCQq4InTdwlRw88vA5IY=";
+                    rev = "10.5.fb";
+                    sha256 = "sha256-X4ApGLkHF9ceBtBg77dimEpu720I79ffLoyPa8JMHaU=";
                  };
-                  version = "v10.4.fb";
+                  version = "v10.5.fb";
                  cmakeFlags =
                    pkgs.lib.subtractLists [
                      # No real reason to have snappy or zlib, no one uses this
@@ -1,12 +1,28 @@
 # Continuwuity for Debian

-This document provides information about downloading and deploying the Debian package. You can also use this guide for other `apt`-based distributions such as Ubuntu.
+This document provides information about downloading and deploying the Debian package. You can also use this guide for other deb-based distributions such as Ubuntu.

 ### Installation

-See the [generic deployment guide](../deploying/generic.md) for additional information about using the Debian package.
+To add the Continuwuation apt repository:
+```bash
+# Replace with `"dev"` for bleeding-edge builds at your own risk
+export COMPONENT="stable"
+# Import the Continuwuation signing key
+sudo curl https://forgejo.ellis.link/api/packages/continuwuation/debian/repository.key -o /etc/apt/keyrings/forgejo-continuwuation.asc
+# Add a new apt source list pointing to the repository
+echo "deb [signed-by=/etc/apt/keyrings/forgejo-continuwuation.asc] https://forgejo.ellis.link/api/packages/continuwuation/debian $(lsb_release -sc) $COMPONENT" | sudo tee /etc/apt/sources.list.d/continuwuation.list
+# Update remote package lists
+sudo apt update
+```

-No `apt` repository is currently available. This feature is in development.
+To install continuwuity:
+```bash
+sudo apt install continuwuity
+```
+The `continuwuity` package conflicts with the old `conduwuit` package and will remove it automatically when installed.
+
+See the [generic deployment guide](../deploying/generic.md) for additional information about using the Debian package.

 ### Configuration

@@ -16,7 +32,7 @@ You can customize additional settings by uncommenting and modifying the configur

 ### Running

-The package uses the [`conduwuit.service`](../configuration/examples.md#example-systemd-unit-file) systemd unit file to start and stop Continuwuity. The binary installs at `/usr/sbin/conduwuit`.
+The package uses the [`conduwuit.service`](../configuration/examples.md#example-systemd-unit-file) systemd unit file to start and stop Continuwuity. The binary installs at `/usr/bin/conduwuit`.

 By default, this package assumes that Continuwuity runs behind a reverse proxy. The default configuration options apply (listening on `localhost` and TCP port `6167`). Matrix federation requires a valid domain name and TLS. To federate properly, you must set up TLS certificates and certificate renewal.

@@ -1,6 +1,5 @@
-# This should be run using rpkg-util: https://docs.pagure.org/rpkg-util
+# This should be run using rpkg: https://docs.pagure.org/rpkg
 # it requires Internet access and is not suitable for Fedora main repos
-# TODO: rpkg-util is no longer maintained, find a replacement

 Name:           continuwuity
 Version:        {{{ git_repo_version }}}
@@ -78,7 +78,7 @@ pub(crate) async fn well_known_support(
 			while let Some(user_id) = stream.next().await {
 				// Skip server user
 				if *user_id == services.globals.server_user {
-					continue;
+					break;
 				}
 				contacts.push(Contact {
 					role: role_value.clone(),
@@ -1,6 +1,6 @@
 use axum::extract::State;
 use conduwuit::{
-	Err, Error, Result, debug_info, info, matrix::pdu::PduBuilder, utils::IterStream, warn,
+	Err, Error, Result, debug_info, matrix::pdu::PduBuilder, utils::IterStream, warn,
 };
 use conduwuit_service::Services;
 use futures::StreamExt;
@@ -22,7 +22,6 @@ use crate::Ruma;
 /// # `GET /_matrix/federation/v1/make_join/{roomId}/{userId}`
 ///
 /// Creates a join template.
-#[tracing::instrument(skip_all, fields(room_id = %body.room_id, user_id = %body.user_id, origin = %body.origin()))]
 pub(crate) async fn create_join_event_template_route(
 	State(services): State<crate::State>,
 	body: Ruma<prepare_join_event::v1::Request>,
@@ -73,16 +72,11 @@ pub(crate) async fn create_join_event_template_route(
 	}

 	let state_lock = services.rooms.state.mutex.lock(&body.room_id).await;
-	let is_invited = services
-		.rooms
-		.state_cache
-		.is_invited(&body.user_id, &body.room_id)
-		.await;
+
 	let join_authorized_via_users_server: Option<OwnedUserId> = {
 		use RoomVersionId::*;
-		if matches!(room_version_id, V1 | V2 | V3 | V4 | V5 | V6 | V7) || is_invited {
-			// room version does not support restricted join rules, or the user is currently
-			// already invited
+		if matches!(room_version_id, V1 | V2 | V3 | V4 | V5 | V6 | V7) {
+			// room version does not support restricted join rules
 			None
 		} else if user_can_perform_restricted_join(
 			&services,
@@ -109,10 +103,6 @@ pub(crate) async fn create_join_event_template_route(
 				.await
 				.map(ToOwned::to_owned)
 			else {
-				info!(
-					"No local user is able to authorize the join of {} into {}",
-					&body.user_id, &body.room_id
-				);
 				return Err!(Request(UnableToGrantJoin(
 					"No user on this server is able to assist in joining."
 				)));
@@ -177,7 +167,6 @@ pub(crate) async fn user_can_perform_restricted_join(
 		)
 		.await
 	else {
-		// No join rules means there's nothing to authorise (defaults to invite)
 		return Ok(false);
 	};

@@ -200,15 +200,11 @@ where
 		if incoming_event.room_id().is_some() {
 			let Some(room_id_server_name) = incoming_event.room_id().unwrap().server_name()
 			else {
-				warn!("legacy room ID has no server name");
+				warn!("room ID has no servername");
 				return Ok(false);
 			};
 			if room_id_server_name != sender.server_name() {
-				warn!(
-					expected = %sender.server_name(),
-					received = %room_id_server_name,
-					"server name of legacy room ID does not match server name of sender"
-				);
+				warn!("servername of room ID does not match servername of sender");
 				return Ok(false);
 			}
 		}
@@ -219,12 +215,12 @@ where
 			.room_version
 			.is_some_and(|v| v.deserialize().is_err())
 		{
-			warn!("unsupported room version found in m.room.create event");
+			warn!("invalid room version found in m.room.create event");
 			return Ok(false);
 		}

 		if room_version.room_ids_as_hashes && incoming_event.room_id().is_some() {
-			warn!("room create event incorrectly claims to have a room ID when it should not");
+			warn!("room create event incorrectly claims a room ID");
 			return Ok(false);
 		}

@@ -233,7 +229,7 @@ where
 		{
 			// If content has no creator field, reject
 			if content.creator.is_none() {
-				warn!("m.room.create event incorrectly omits 'creator' field");
+				warn!("no creator field found in m.room.create content");
 				return Ok(false);
 			}
 		}
@@ -286,19 +282,16 @@ where
 		.room_version
 		.is_some_and(|v| v.deserialize().is_err())
 	{
-		warn!(
-			create_event_id = %room_create_event.event_id(),
-			"unsupported room version found in m.room.create event"
-		);
+		warn!("invalid room version found in m.room.create event");
 		return Ok(false);
 	}
 	let expected_room_id = room_create_event.room_id_or_hash();

-	if incoming_event.room_id().expect("event must have a room ID") != expected_room_id {
+	if incoming_event.room_id().unwrap() != expected_room_id {
 		warn!(
 			expected = %expected_room_id,
 			received = %incoming_event.room_id().unwrap(),
-			"room_id of incoming event ({}) does not match that of the m.room.create event ({})",
+			"room_id of incoming event ({}) does not match room_id of m.room.create event ({})",
 			incoming_event.room_id().unwrap(),
 			expected_room_id,
 		);
@@ -311,15 +304,12 @@ where
 		.auth_events()
 		.any(|id| id == room_create_event.event_id());
 	if room_version.room_ids_as_hashes && claims_create_event {
-		warn!("event incorrectly references m.room.create event in auth events");
+		warn!("m.room.create event incorrectly found in auth events");
 		return Ok(false);
 	} else if !room_version.room_ids_as_hashes && !claims_create_event {
 		// If the create event is not referenced in the event's auth events, and this is
 		// a v11 room, reject
-		warn!(
-			missing = %room_create_event.event_id(),
-			"event incorrectly did not reference an m.room.create in its auth events"
-		);
+		warn!("no m.room.create event found in auth events");
 		return Ok(false);
 	}

@@ -328,7 +318,7 @@ where
 			warn!(
 				expected = %expected_room_id,
 				received = %pe.room_id().unwrap(),
-				"room_id of referenced power levels event does not match that of the m.room.create event"
+				"room_id of power levels event does not match room_id of m.room.create event"
 			);
 			return Ok(false);
 		}
@@ -342,9 +332,8 @@ where
 		&& room_create_event.sender().server_name() != incoming_event.sender().server_name()
 	{
 		warn!(
-			sender = %incoming_event.sender(),
-			create_sender = %room_create_event.sender(),
-			"room is not federated and event's sender domain does not match create event's sender domain"
+			"room is not federated and event's sender domain does not match create event's \
+			 sender domain"
 		);
 		return Ok(false);
 	}
@@ -427,6 +416,7 @@ where
 			&user_for_join_auth_membership,
 			&room_create_event,
 		)? {
+			warn!("membership change not valid for some reason");
 			return Ok(false);
 		}

@@ -439,7 +429,7 @@ where
 	let sender_member_event = match sender_member_event {
 		| Some(mem) => mem,
 		| None => {
-			warn!("sender has no membership event");
+			warn!("sender not found in room");
 			return Ok(false);
 		},
 	};
@@ -450,7 +440,7 @@ where
 		!= expected_room_id
 	{
 		warn!(
-			"room_id of incoming event ({}) does not match that of the m.room.create event ({})",
+			"room_id of incoming event ({}) does not match room_id of m.room.create event ({})",
 			sender_member_event
 				.room_id()
 				.expect("event must have a room ID"),
@@ -463,7 +453,8 @@ where
 		from_json_str(sender_member_event.content().get())?;
 	let Some(membership_state) = sender_membership_event_content.membership else {
 		warn!(
-			?sender_membership_event_content,
+			sender_membership_event_content = format!("{sender_membership_event_content:?}"),
+			event_id = format!("{}", incoming_event.event_id()),
 			"Sender membership event content missing membership field"
 		);
 		return Err(Error::InvalidPdu("Missing membership field".to_owned()));
@@ -471,11 +462,7 @@ where
 	let membership_state = membership_state.deserialize()?;

 	if !matches!(membership_state, MembershipState::Join) {
-		warn!(
-			%sender,
-			?membership_state,
-			"sender cannot send events without being joined to the room"
-		);
+		warn!("sender's membership is not join");
 		return Ok(false);
 	}

@@ -535,12 +522,7 @@ where
 		};

 		if sender_power_level < invite_level {
-			warn!(
-				%sender,
-				has=?sender_power_level,
-				required=?invite_level,
-				"sender cannot send invites in this room"
-			);
+			warn!("sender's cannot send invites in this room");
 			return Ok(false);
 		}

@@ -552,11 +534,7 @@ where
 	// level, reject If the event has a state_key that starts with an @ and does
 	// not match the sender, reject.
 	if !can_send_event(incoming_event, power_levels_event.as_ref(), sender_power_level) {
-		warn!(
-			%sender,
-			event_type=?incoming_event.kind(),
-			"sender cannot send event"
-		);
+		warn!("user cannot send event");
 		return Ok(false);
 	}

@@ -601,12 +579,6 @@ where
 		};

 		if !check_redaction(room_version, incoming_event, sender_power_level, redact_level)? {
-			warn!(
-				%sender,
-				?sender_power_level,
-				?redact_level,
-				"redaction event was not allowed"
-			);
 			return Ok(false);
 		}
 	}
@@ -615,21 +587,15 @@ where
 	Ok(true)
 }

-fn is_creator<EV>(
-	v: &RoomVersion,
-	c: &BTreeSet<OwnedUserId>,
-	ce: &EV,
-	user_id: &UserId,
-	have_pls: bool,
-) -> bool
+fn is_creator<EV>(v: &RoomVersion, c: &BTreeSet<OwnedUserId>, ce: &EV, user_id: &UserId) -> bool
 where
 	EV: Event + Send + Sync,
 {
 	if v.explicitly_privilege_room_creators {
 		c.contains(user_id)
-	} else if v.use_room_create_sender && !have_pls {
+	} else if v.use_room_create_sender {
 		ce.sender() == user_id
-	} else if !have_pls {
+	} else {
 		#[allow(deprecated)]
 		let creator = from_json_str::<RoomCreateEventContent>(ce.content().get())
 			.unwrap()
@@ -638,8 +604,6 @@ where
 			.unwrap();

 		creator == user_id
-	} else {
-		false
 	}
 }

@@ -732,11 +696,10 @@ where
 	}
 	trace!(?creators, "creators for room");

-	let join_rules = if let Some(jr) = &join_rules_event {
-		from_json_str::<RoomJoinRulesEventContent>(jr.content().get())?.join_rule
-	} else {
-		JoinRule::Invite
-	};
+	let mut join_rules = JoinRule::Invite;
+	if let Some(jr) = &join_rules_event {
+		join_rules = from_json_str::<RoomJoinRulesEventContent>(jr.content().get())?.join_rule;
+	}

 	let power_levels_event_id = power_levels_event.as_ref().map(Event::event_id);
 	let sender_membership_event_id = sender_membership_event.as_ref().map(Event::event_id);
@@ -762,13 +725,8 @@ where
 			(int!(0), int!(0))
 		};
 		let user_joined = user_for_join_auth_membership == &MembershipState::Join;
-		let okay_power = is_creator(
-			room_version,
-			&creators,
-			create_room,
-			user_for_join_auth,
-			power_levels_event.as_ref().is_some(),
-		) || auth_user_pl >= invite_level;
+		let okay_power = is_creator(room_version, &creators, create_room, user_for_join_auth)
+			|| auth_user_pl >= invite_level;
 		trace!(
 			auth_user_pl=?auth_user_pl,
 			invite_level=?invite_level,
@@ -783,20 +741,8 @@ where
 		trace!("No auth user given for join auth");
 		false
 	};
-	let sender_creator = is_creator(
-		room_version,
-		&creators,
-		create_room,
-		sender,
-		power_levels_event.as_ref().is_some(),
-	);
-	let target_creator = is_creator(
-		room_version,
-		&creators,
-		create_room,
-		target_user,
-		power_levels_event.as_ref().is_some(),
-	);
+	let sender_creator = is_creator(room_version, &creators, create_room, sender);
+	let target_creator = is_creator(room_version, &creators, create_room, target_user);

 	Ok(match target_membership {
 		| MembershipState::Join => {
@@ -813,7 +759,7 @@ where

 			if prev_event_is_create_event && no_more_prev_events {
 				trace!(
-					%sender,
+					sender = %sender,
 					target_user = %target_user,
 					?sender_creator,
 					?target_creator,
@@ -833,33 +779,22 @@ where
 			);
 			if sender != target_user {
 				// If the sender does not match state_key, reject.
-				warn!(
-					%sender,
-					target_user = %target_user,
-					"sender cannot join on behalf of another user"
-				);
+				warn!("Can't make other user join");
 				false
 			} else if target_user_current_membership == MembershipState::Ban {
 				// If the sender is banned, reject.
-				warn!(
-					%sender,
-					membership_event_id = ?target_user_membership_event_id,
-					"sender cannot join as they are banned from the room"
-				);
+				warn!(?target_user_membership_event_id, "Banned user can't join");
 				false
 			} else {
 				match join_rules {
 					| JoinRule::Invite =>
 						if !membership_allows_join {
 							warn!(
-								%sender,
-								membership_event_id = ?target_user_membership_event_id,
-								membership = ?target_user_current_membership,
-								"sender cannot join as they are not invited to the invite-only room"
+								membership=?target_user_current_membership,
+								"Join rule is invite but membership does not allow join"
 							);
 							false
 						} else {
-							trace!(sender=%sender, "sender is invited to room, allowing join");
 							true
 						},
 					| JoinRule::Knock if !room_version.allow_knocking => {
@@ -869,14 +804,11 @@ where
 					| JoinRule::Knock =>
 						if !membership_allows_join {
 							warn!(
-								%sender,
-								membership_event_id = ?target_user_membership_event_id,
 								membership=?target_user_current_membership,
-								"sender cannot join a knock room without being invited or already joined"
+								"Join rule is knock but membership does not allow join"
 							);
 							false
 						} else {
-							trace!(sender=%sender, "sender is invited or already joined to room, allowing join");
 							true
 						},
 					| JoinRule::KnockRestricted(_) if !room_version.knock_restricted_join_rule =>
@@ -888,55 +820,33 @@ where
 					},
 					| JoinRule::KnockRestricted(_) => {
 						if membership_allows_join || user_for_join_auth_is_valid {
-							trace!(
-								%sender,
-								%membership_allows_join,
-								%user_for_join_auth_is_valid,
-								"sender is invited, already joined to, or authorised to join the room, allowing join"
-							);
 							true
 						} else {
 							warn!(
-								%sender,
-								membership_event_id = ?target_user_membership_event_id,
 								membership=?target_user_current_membership,
-								%user_for_join_auth_is_valid,
-								?user_for_join_auth,
-								"sender cannot join as they are not invited nor already joined to the room, nor was a \
-								 valid authorising user given to permit the join"
+								"Join rule is a restricted one, but no valid authorising user \
+								 was given and the sender's current membership does not permit \
+								 a join transition"
 							);
 							false
 						}
 					},
 					| JoinRule::Restricted(_) =>
 						if membership_allows_join || user_for_join_auth_is_valid {
-							trace!(
-								%sender,
-								%membership_allows_join,
-								%user_for_join_auth_is_valid,
-								"sender is invited, already joined to, or authorised to join the room, allowing join"
-							);
 							true
 						} else {
 							warn!(
-								%sender,
-								membership_event_id = ?target_user_membership_event_id,
-								membership=?target_user_current_membership,
-								%user_for_join_auth_is_valid,
-								?user_for_join_auth,
-								"sender cannot join as they are not invited nor already joined to the room, nor was a \
-								 valid authorising user given to permit the join"
+								"Join rule is a restricted one but no valid authorising user \
+								 was given"
 							);
 							false
 						},
-					| JoinRule::Public => {
-						trace!(%sender, "join rule is public, allowing join");
-						true
-					},
+					| JoinRule::Public => true,
 					| _ => {
 						warn!(
 							join_rule=?join_rules,
-							"Join rule is unknown, or the rule's conditions were not met"
+							membership=?target_user_current_membership,
+							"Unknown join rule doesn't allow joining, or the rule's conditions were not met"
 						);
 						false
 					},
@@ -963,23 +873,16 @@ where
 						}
 						allow
 					},
-				| _ =>
-					if !sender_is_joined {
-						warn!(
-							%sender,
-							?sender_membership_event_id,
-							?sender_membership,
-							"sender cannot produce an invite without being joined to the room",
-						);
-						false
-					} else if matches!(
-						target_user_current_membership,
-						MembershipState::Join | MembershipState::Ban
-					) {
+				| _ => {
+					if !sender_is_joined
+						|| target_user_current_membership == MembershipState::Join
+						|| target_user_current_membership == MembershipState::Ban
+					{
 						warn!(
 							?target_user_membership_event_id,
-							?target_user_current_membership,
-							"cannot invite a user who is banned or already joined",
+							?sender_membership_event_id,
+							"Can't invite user if sender not joined or the user is currently \
+							 joined or banned",
 						);
 						false
 					} else {
@@ -989,124 +892,56 @@ where
 								.is_some();
 						if !allow {
 							warn!(
-								%sender,
-								has=?sender_power,
-								required=?power_levels.invite,
-								"sender does not have enough power to produce invites",
+								?target_user_membership_event_id,
+								?power_levels_event_id,
+								"User does not have enough power to invite",
 							);
 						}
-						trace!(
-							%sender,
-							?sender_membership_event_id,
-							?sender_membership,
-							?target_user_membership_event_id,
-							?target_user_current_membership,
-							sender_pl=?sender_power,
-							required_pl=?power_levels.invite,
-							"allowing invite"
-						);
 						allow
-					},
+					}
+				},
 			}
 		},
-		| MembershipState::Leave => {
-			let can_unban = if target_user_current_membership == MembershipState::Ban {
-				sender_creator || sender_power.filter(|&p| p >= &power_levels.ban).is_some()
-			} else {
-				true
-			};
-			let can_kick = if !matches!(
-				target_user_current_membership,
-				MembershipState::Ban | MembershipState::Leave
-			) {
-				if sender_creator {
-					// sender is a creator
-					true
-				} else if sender_power.filter(|&p| p >= &power_levels.kick).is_none() {
-					// sender lacks kick power level
-					false
-				} else if let Some(sp) = sender_power {
-					if let Some(tp) = target_power {
-						// sender must have more power than target
-						sp > tp
-					} else {
-						// target has default power level
-						true
-					}
-				} else {
-					// sender has default power level
-					false
-				}
-			} else {
-				true
-			};
+		| MembershipState::Leave =>
 			if sender == target_user {
-				// self-leave
-				// let allow = target_user_current_membership == MembershipState::Join
-				// 	|| target_user_current_membership == MembershipState::Invite
-				// 	|| target_user_current_membership == MembershipState::Knock;
-				let allow = matches!(
-					target_user_current_membership,
-					MembershipState::Join | MembershipState::Invite | MembershipState::Knock
-				);
+				let allow = target_user_current_membership == MembershipState::Join
+					|| target_user_current_membership == MembershipState::Invite
+					|| target_user_current_membership == MembershipState::Knock;
 				if !allow {
 					warn!(
-						%sender,
-						current_membership_event_id=?target_user_membership_event_id,
-						current_membership=?target_user_current_membership,
-						"sender cannot leave as they are not already knocking on, invited to, or joined to the room"
+						?target_user_membership_event_id,
+						?target_user_current_membership,
+						"Can't leave if sender is not already invited, knocked, or joined"
 					);
 				}
-				trace!(sender=%sender, "allowing leave");
 				allow
-			} else if !sender_is_joined {
+			} else if !sender_is_joined
+				|| target_user_current_membership == MembershipState::Ban
+					&& (sender_creator
+						|| sender_power.filter(|&p| p < &power_levels.ban).is_some())
+			{
 				warn!(
-					%sender,
+					?target_user_membership_event_id,
 					?sender_membership_event_id,
-					"sender cannot kick another user as they are not joined to the room",
-				);
-				false
-			} else if !(can_unban && can_kick) {
-				// If the target is banned, only a room creator or someone with ban power
-				// level can unban them
-				warn!(
-					%sender,
-					?target_user_membership_event_id,
-					?power_levels_event_id,
-					"sender lacks the power level required to unban users",
-				);
-				false
-			} else if !can_kick {
-				warn!(
-					%sender,
-					%target_user,
-					?target_user_membership_event_id,
-					?target_user_current_membership,
-					?power_levels_event_id,
-					"sender does not have enough power to kick the target",
+					"Can't kick if sender not joined or user is already banned",
 				);
 				false
 			} else {
-				trace!(
-					%sender,
-					%target_user,
-					?target_user_membership_event_id,
-					?target_user_current_membership,
-					sender_pl=?sender_power,
-					target_pl=?target_power,
-					required_pl=?power_levels.kick,
-					"allowing kick/unban",
-				);
-				true
-			}
-		},
+				let allow = sender_creator
+					|| (sender_power.filter(|&p| p >= &power_levels.kick).is_some()
+						&& target_power < sender_power);
+				if !allow {
+					warn!(
+						?target_user_membership_event_id,
+						?power_levels_event_id,
+						"User does not have enough power to kick",
+					);
+				}
+				allow
+			},
 		| MembershipState::Ban =>
 			if !sender_is_joined {
-				warn!(
-					%sender,
-					?sender_membership_event_id,
-					"sender cannot ban another user as they are not joined to the room",
-				);
+				warn!(?sender_membership_event_id, "Can't ban user if sender is not joined");
 				false
 			} else {
 				let allow = sender_creator
@@ -1114,11 +949,9 @@ where
 						&& target_power < sender_power);
 				if !allow {
 					warn!(
-						%sender,
-						%target_user,
 						?target_user_membership_event_id,
 						?power_levels_event_id,
-						"sender does not have enough power to ban the target",
+						"User does not have enough power to ban",
 					);
 				}
 				allow
@@ -1144,9 +977,9 @@ where
 			} else if sender != target_user {
 				// 3. If `sender` does not match `state_key`, reject.
 				warn!(
-					%sender,
-					%target_user,
-					"sender cannot knock on behalf of another user",
+					?sender,
+					?target_user,
+					"Can't make another user knock, sender did not match target"
 				);
 				false
 			} else if matches!(
@@ -1158,25 +991,15 @@ where
 				// 5. Otherwise, reject.
 				warn!(
 					?target_user_membership_event_id,
-					?sender_membership,
 					"Knocking with a membership state of ban, invite or join is invalid",
 				);
 				false
 			} else {
-				trace!(%sender, "allowing knock");
 				true
 			}
 		},
 		| _ => {
-			warn!(
-				%sender,
-				?target_membership,
-				%target_user,
-				%target_user_current_membership,
-				"Unknown or invalid membership transition {} -> {}",
-				target_user_current_membership,
-				target_membership
-			);
+			warn!("Unknown membership transition");
 			false
 		},
 	})
@@ -1206,13 +1029,6 @@ fn can_send_event(event: &impl Event, ple: Option<&impl Event>, user_level: Int)
 	if event.state_key().is_some_and(|k| k.starts_with('@'))
 		&& event.state_key() != Some(event.sender().as_str())
 	{
-		warn!(
-			%user_level,
-			required=?event_type_power_level,
-			state_key=?event.state_key(),
-			sender=%event.sender(),
-			"state_key starts with @ but does not match sender",
-		);
 		return false; // permission required to post in this room
 	}

@@ -1297,14 +1113,7 @@ fn check_power_levels(

 		// If the current value is equal to the sender's current power level, reject
 		if user != power_event.sender() && old_level == Some(&user_level) {
-			warn!(
-				?old_level,
-				?new_level,
-				?user,
-				%user_level,
-				sender=%power_event.sender(),
-				"cannot alter the power level of a user with the same power level as sender's own"
-			);
+			warn!("m.room.power_level cannot remove ops == to own");
 			return Some(false); // cannot remove ops level == to own
 		}

@@ -1312,26 +1121,8 @@ fn check_power_levels(
 		// If the new value is higher than the sender's current power level, reject
 		let old_level_too_big = old_level > Some(&user_level);
 		let new_level_too_big = new_level > Some(&user_level);
-		if old_level_too_big {
-			warn!(
-				?old_level,
-				?new_level,
-				?user,
-				%user_level,
-				sender=%power_event.sender(),
-				"cannot alter the power level of a user with a higher power level than sender's own"
-			);
-			return Some(false); // cannot add ops greater than own
-		}
-		if new_level_too_big {
-			warn!(
-				?old_level,
-				?new_level,
-				?user,
-				%user_level,
-				sender=%power_event.sender(),
-				"cannot set the power level of a user to a level higher than sender's own"
-			);
+		if old_level_too_big || new_level_too_big {
+			warn!("m.room.power_level failed to add ops > than own");
 			return Some(false); // cannot add ops greater than own
 		}
 	}
@@ -1348,26 +1139,8 @@ fn check_power_levels(
 		// If the new value is higher than the sender's current power level, reject
 		let old_level_too_big = old_level > Some(&user_level);
 		let new_level_too_big = new_level > Some(&user_level);
-		if old_level_too_big {
-			warn!(
-				?old_level,
-				?new_level,
-				?ev_type,
-				%user_level,
-				sender=%power_event.sender(),
-				"cannot alter the power level of an event with a higher power level than sender's own"
-			);
-			return Some(false); // cannot add ops greater than own
-		}
-		if new_level_too_big {
-			warn!(
-				?old_level,
-				?new_level,
-				?ev_type,
-				%user_level,
-				sender=%power_event.sender(),
-				"cannot set the power level of an event to a level higher than sender's own"
-			);
+		if old_level_too_big || new_level_too_big {
+			warn!("m.room.power_level failed to add ops > than own");
 			return Some(false); // cannot add ops greater than own
 		}
 	}
@@ -1382,13 +1155,7 @@ fn check_power_levels(
 			let old_level_too_big = old_level > user_level;
 			let new_level_too_big = new_level > user_level;
 			if old_level_too_big || new_level_too_big {
-				warn!(
-					?old_level,
-					?new_level,
-					%user_level,
-					sender=%power_event.sender(),
-					"cannot alter the power level of notifications greater than sender's own"
-				);
+				warn!("m.room.power_level failed to add ops > than own");
 				return Some(false); // cannot add ops greater than own
 			}
 		}
@@ -1412,14 +1179,7 @@ fn check_power_levels(
 			let new_level_too_big = new_lvl > user_level;

 			if old_level_too_big || new_level_too_big {
-				warn!(
-					?old_lvl,
-					?new_lvl,
-					%user_level,
-					sender=%power_event.sender(),
-					action=%lvl_name,
-					"cannot alter the power level of action greater than sender's own",
-				);
+				warn!("cannot add ops > than own");
 				return Some(false);
 			}
 		}
@@ -36,7 +36,7 @@ pub use self::{
 	room_version::RoomVersion,
 };
 use crate::{
-	debug, debug_error, err,
+	debug, debug_error,
 	matrix::{Event, StateKey},
 	state_res::room_version::StateResolutionVersion,
 	trace,
@@ -101,40 +101,40 @@ where
 	debug!(version = ?stateres_version, "State resolution starting");

 	// Split non-conflicting and conflicting state
-	let (unconflicted, conflicting) = separate(state_sets.into_iter());
+	let (clean, conflicting) = separate(state_sets.into_iter());

-	debug!(count = unconflicted.len(), "non-conflicting events");
-	trace!(map = ?unconflicted, "non-conflicting events");
+	debug!(count = clean.len(), "non-conflicting events");
+	trace!(map = ?clean, "non-conflicting events");

 	if conflicting.is_empty() {
 		debug!("no conflicting state found");
-		return Ok(unconflicted);
+		return Ok(clean);
 	}

 	debug!(count = conflicting.len(), "conflicting events");
 	trace!(map = ?conflicting, "conflicting events");
-	let (conflicted_state_subgraph, initial_state) =
-		if stateres_version == StateResolutionVersion::V2_1 {
-			let csg = calculate_conflicted_subgraph(&conflicting, event_fetch)
+	let conflicted_state_subgraph: HashSet<_> = match stateres_version {
+		| StateResolutionVersion::V2_1 =>
+			calculate_conflicted_subgraph(&conflicting, event_fetch)
 				.await
 				.ok_or_else(|| {
 					Error::InvalidPdu("Failed to calculate conflicted subgraph".to_owned())
-				})?;
-			debug!(count = csg.len(), "conflicted subgraph");
-			trace!(set = ?csg, "conflicted subgraph");
-			(csg, HashMap::new())
-		} else {
-			(HashSet::new(), unconflicted.clone())
-		};
+				})?,
+		| _ => HashSet::new(),
+	};
+	debug!(count = conflicted_state_subgraph.len(), "conflicted subgraph");
+	trace!(set = ?conflicted_state_subgraph, "conflicted subgraph");
+
+	let conflicting_values = conflicting.into_values().flatten().stream();

 	// `all_conflicted` contains unique items
 	// synapse says `full_set = {eid for eid in full_conflicted_set if eid in
 	// event_map}`
 	// Hydra: Also consider the conflicted state subgraph
 	let all_conflicted: HashSet<_> = get_auth_chain_diff(auth_chain_sets)
-		.chain(conflicting.into_values().flatten().stream())
-		.broad_filter_map(async |id| event_exists(id.clone()).await.then_some(id))
+		.chain(conflicting_values)
 		.chain(conflicted_state_subgraph.into_iter().stream())
+		.broad_filter_map(async |id| event_exists(id.clone()).await.then_some(id))
 		.collect()
 		.await;

@@ -169,8 +169,9 @@ where
 	// Sequentially auth check each control event.
 	let resolved_control = iterative_auth_check(
 		&room_version,
+		&stateres_version,
 		sorted_control_levels.iter().stream().map(AsRef::as_ref),
-		initial_state,
+		clean.clone(),
 		&event_fetch,
 	)
 	.await?;
@@ -200,7 +201,7 @@ where
 	let power_levels_ty_sk = (StateEventType::RoomPowerLevels, StateKey::new());
 	let power_event = resolved_control.get(&power_levels_ty_sk);

-	trace!(event_id = ?power_event, "power event");
+	debug!(event_id = ?power_event, "power event");

 	let sorted_left_events =
 		mainline_sort(&events_to_resolve, power_event.cloned(), &event_fetch).await?;
@@ -209,14 +210,21 @@ where

 	let mut resolved_state = iterative_auth_check(
 		&room_version,
+		&stateres_version,
 		sorted_left_events.iter().stream().map(AsRef::as_ref),
-		resolved_control, // The control events are added to the final resolved state
+		resolved_control.clone(), // The control events are added to the final resolved state
 		&event_fetch,
 	)
 	.await?;

-	// Ensure unconflicting state is in the final state
-	resolved_state.extend(unconflicted);
+	// Add unconflicted state to the resolved state
+	// We priorities the unconflicting state
+	resolved_state.extend(clean);
+	if stateres_version == StateResolutionVersion::V2_1 {
+		resolved_state.extend(resolved_control);
+		// TODO(hydra): this feels disgusting and wrong but it allows
+		// the state to resolve properly?
+	}

 	debug!("state resolution finished");
 	trace!( map = ?resolved_state, "final resolved state" );
@@ -311,19 +319,8 @@ where
 			path.pop();
 			continue;
 		}
-		trace!(event_id = event_id.as_str(), "fetching event for its auth events");
-		let evt = fetch_event(event_id.clone()).await;
-		if evt.is_none() {
-			err!("could not fetch event {} to calculate conflicted subgraph", event_id);
-			path.pop();
-			continue;
-		}
-		stack.push(
-			evt.expect("checked")
-				.auth_events()
-				.map(ToOwned::to_owned)
-				.collect(),
-		);
+		let evt = fetch_event(event_id.clone()).await?;
+		stack.push(evt.auth_events().map(ToOwned::to_owned).collect());
 		seen.insert(event_id);
 	}
 	Some(subgraph)
@@ -595,6 +592,7 @@ where
 #[tracing::instrument(level = "trace", skip_all)]
 async fn iterative_auth_check<'a, E, F, Fut, S>(
 	room_version: &RoomVersion,
+	stateres_version: &StateResolutionVersion,
 	events_to_check: S,
 	unconflicted_state: StateMap<OwnedEventId>,
 	fetch_event: &F,
@@ -619,10 +617,6 @@ where
 		.boxed()
 		.await?;
 	trace!(list = ?events_to_check, "events to check");
-	if events_to_check.is_empty() {
-		debug!("no events to check, returning unconflicted state");
-		return Ok(unconflicted_state);
-	}

 	let auth_event_ids: HashSet<OwnedEventId> = events_to_check
 		.iter()
@@ -643,11 +637,10 @@ where
 	trace!(map = ?auth_events.keys().collect::<Vec<_>>(), "fetched auth events");

 	let auth_events = &auth_events;
-	// NOTE: in state resolution v2.1, auth checks should start with an empty state
-	// map. It is the caller's job to do this. Previously, this function would
-	// force an empty state map in this case, and this resulted in power events
-	// going missing from the resolved state as they'd be discarded here.
-	let mut resolved_state = unconflicted_state;
+	let mut resolved_state = match stateres_version {
+		| StateResolutionVersion::V2_1 => StateMap::new(),
+		| _ => unconflicted_state,
+	};
 	for event in events_to_check {
 		trace!(event_id = event.event_id().as_str(), "checking event");
 		let state_key = event
@@ -1035,6 +1028,7 @@ mod tests {

 		let resolved_power = super::iterative_auth_check(
 			&RoomVersion::V6,
+			&StateResolutionVersion::V2,
 			sorted_power_events.iter().map(AsRef::as_ref).stream(),
 			HashMap::new(), // unconflicted events
 			&fetcher,
@@ -22,11 +22,13 @@ crate-type = [
 ]

 [package.metadata.deb]
-name = "conduwuit"
-maintainer = "strawberry <strawberry@puppygock.gay>"
-copyright = "2024, strawberry <strawberry@puppygock.gay>"
+name = "continuwuity"
+maintainer = "continuwuity developers <contact@continuwuity.org>"
+copyright = "2024, continuwuity developers"
 license-file = ["../../LICENSE", "3"]
 depends = "$auto, ca-certificates"
+breaks = ["conduwuit (<<0.5.0)"]
+replaces = ["conduwuit (<<0.5.0)"]
 extended-description = """\
 a cool hard fork of Conduit, a Matrix homeserver written in Rust"""
 section = "net"
@@ -9,7 +9,6 @@ use conduwuit::{
 	},
 	warn,
 };
-use database::Json;
 use futures::{FutureExt, StreamExt, TryStreamExt};
 use itertools::Itertools;
 use ruma::{
@@ -607,7 +606,7 @@ async fn fix_corrupt_msc4133_fields(services: &Services) -> Result {
 						);
 					};

-					useridprofilekey_value.put((user, key), Json(new_value));
+					useridprofilekey_value.put((user, key), new_value);
 					fixed = fixed.saturating_add(1);
 				}
 				total = total.saturating_add(1);
@@ -4,8 +4,9 @@ use std::{
 };

 use conduwuit::{
-	Event, PduEvent, debug, debug_warn, implement, matrix::event::gen_event_id_canonical_json,
-	trace, utils::continue_exponential_backoff_secs, warn,
+	Event, PduEvent, debug, debug_error, debug_warn, implement,
+	matrix::event::gen_event_id_canonical_json, trace, utils::continue_exponential_backoff_secs,
+	warn,
 };
 use ruma::{
 	CanonicalJsonValue, EventId, OwnedEventId, RoomId, ServerName,
@@ -51,14 +52,12 @@ where
 	};

 	let mut events_with_auth_events = Vec::with_capacity(events.clone().count());
-	trace!("Fetching {} outlier pdus", events.clone().count());

 	for id in events {
 		// a. Look in the main timeline (pduid_pdu tree)
 		// b. Look at outlier pdu tree
 		// (get_pdu_json checks both)
 		if let Ok(local_pdu) = self.services.timeline.get_pdu(id).await {
-			trace!("Found {id} in main timeline or outlier tree");
 			events_with_auth_events.push((id.to_owned(), Some(local_pdu), vec![]));
 			continue;
 		}
@@ -105,7 +104,7 @@ where
 				continue;
 			}

-			debug!("Fetching {next_id} over federation from {origin}.");
+			debug!("Fetching {next_id} over federation.");
 			match self
 				.services
 				.sending
@@ -116,7 +115,7 @@ where
 				.await
 			{
 				| Ok(res) => {
-					debug!("Got {next_id} over federation from {origin}");
+					debug!("Got {next_id} over federation");
 					let Ok(room_version_id) = get_room_version_id(create_event) else {
 						back_off((*next_id).to_owned());
 						continue;
@@ -146,9 +145,6 @@ where
 								auth_event.clone().into(),
 							) {
 								| Ok(auth_event) => {
-									trace!(
-										"Found auth event id {auth_event} for event {next_id}"
-									);
 									todo_auth_events.push_back(auth_event);
 								},
 								| _ => {
@@ -164,7 +160,7 @@ where
 					events_all.insert(next_id);
 				},
 				| Err(e) => {
-					warn!("Failed to fetch auth event {next_id} from {origin}: {e}");
+					debug_error!("Failed to fetch event {next_id}: {e}");
 					back_off((*next_id).to_owned());
 				},
 			}
@@ -179,7 +175,7 @@ where
 		// b. Look at outlier pdu tree
 		// (get_pdu_json checks both)
 		if let Some(local_pdu) = local_pdu {
-			trace!("Found {id} in main timeline or outlier tree");
+			trace!("Found {id} in db");
 			pdus.push((local_pdu.clone(), None));
 		}

@@ -205,7 +201,6 @@ where
 				}
 			}

-			trace!("Handling outlier {next_id}");
 			match Box::pin(self.handle_outlier_pdu(
 				origin,
 				create_event,
@@ -218,7 +213,6 @@ where
 			{
 				| Ok((pdu, json)) =>
 					if next_id == *id {
-						trace!("Handled outlier {next_id} (original request)");
 						pdus.push((pdu, Some(json)));
 					},
 				| Err(e) => {
@@ -228,6 +222,6 @@ where
 			}
 		}
 	}
-	trace!("Fetched and handled {} outlier pdus", pdus.len());
+
 	pdus
 }
@@ -1,12 +1,11 @@
 use std::collections::{BTreeMap, HashMap, hash_map};

 use conduwuit::{
-	Err, Event, PduEvent, Result, debug, debug_info, debug_warn, err, implement, state_res, trace,
+	Err, Event, PduEvent, Result, debug, debug_info, err, implement, state_res, trace, warn,
 };
 use futures::future::ready;
 use ruma::{
-	CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, RoomId, ServerName,
-	events::StateEventType,
+	CanonicalJsonObject, CanonicalJsonValue, EventId, RoomId, ServerName, events::StateEventType,
 };

 use super::{check_room_id, get_room_version_id, to_room_version};
@@ -75,73 +74,36 @@ where

 	check_room_id(room_id, &pdu_event)?;

-	// Fetch all auth events
-	let mut auth_events: HashMap<OwnedEventId, PduEvent> = HashMap::new();
-
-	for aid in pdu_event.auth_events() {
-		if let Ok(auth_event) = self.services.timeline.get_pdu(aid).await {
-			check_room_id(room_id, &auth_event)?;
-			trace!("Found auth event {aid} for outlier event {event_id} locally");
-			auth_events.insert(aid.to_owned(), auth_event);
-		} else {
-			debug_warn!("Could not find auth event {aid} for outlier event {event_id} locally");
-		}
-	}
-
-	// Fetch any missing ones & reject invalid ones
-	let missing_auth_events = if auth_events_known {
-		pdu_event
-			.auth_events()
-			.filter(|id| !auth_events.contains_key(*id))
-			.collect::<Vec<_>>()
-	} else {
-		pdu_event.auth_events().collect::<Vec<_>>()
-	};
-	if !missing_auth_events.is_empty() || !auth_events_known {
-		debug_info!(
-			"Fetching {} missing auth events for outlier event {event_id}",
-			missing_auth_events.len()
-		);
-		for (pdu, _) in self
-			.fetch_and_handle_outliers(
-				origin,
-				missing_auth_events.iter().copied(),
-				create_event,
-				room_id,
-			)
-			.await
-		{
-			auth_events.insert(pdu.event_id().to_owned(), pdu);
-		}
-	} else {
-		debug!("No missing auth events for outlier event {event_id}");
-	}
-	// reject if we are still missing some
-	let still_missing = pdu_event
-		.auth_events()
-		.filter(|id| !auth_events.contains_key(*id))
-		.collect::<Vec<_>>();
-	if !still_missing.is_empty() {
-		return Err!(Request(InvalidParam(
-			"Could not fetch all auth events for outlier event {event_id}, still missing: \
-			 {still_missing:?}"
-		)));
+	if !auth_events_known {
+		// 4. fetch any missing auth events doing all checks listed here starting at 1.
+		//    These are not timeline events
+		// 5. Reject "due to auth events" if can't get all the auth events or some of
+		//    the auth events are also rejected "due to auth events"
+		// NOTE: Step 5 is not applied anymore because it failed too often
+		debug!("Fetching auth events");
+		Box::pin(self.fetch_and_handle_outliers(
+			origin,
+			pdu_event.auth_events(),
+			create_event,
+			room_id,
+		))
+		.await;
 	}

 	// 6. Reject "due to auth events" if the event doesn't pass auth based on the
 	//    auth events
 	debug!("Checking based on auth events");
-	let mut auth_events_by_key: HashMap<_, _> = HashMap::with_capacity(auth_events.len());
 	// Build map of auth events
+	let mut auth_events = HashMap::with_capacity(pdu_event.auth_events().count());
 	for id in pdu_event.auth_events() {
-		let auth_event = auth_events
-			.get(id)
-			.expect("we just checked that we have all auth events")
-			.to_owned();
+		let Ok(auth_event) = self.services.timeline.get_pdu(id).await else {
+			warn!("Could not find auth event {id}");
+			continue;
+		};

 		check_room_id(room_id, &auth_event)?;

-		match auth_events_by_key.entry((
+		match auth_events.entry((
 			auth_event.kind.to_string().into(),
 			auth_event
 				.state_key
@@ -161,7 +123,7 @@ where

 	// The original create event must be in the auth events
 	if !matches!(
-		auth_events_by_key.get(&(StateEventType::RoomCreate, String::new().into())),
+		auth_events.get(&(StateEventType::RoomCreate, String::new().into())),
 		Some(_) | None
 	) {
 		return Err!(Request(InvalidParam("Incoming event refers to wrong create event.")));
@@ -169,7 +131,7 @@ where

 	let state_fetch = |ty: &StateEventType, sk: &str| {
 		let key = (ty.to_owned(), sk.into());
-		ready(auth_events_by_key.get(&key).map(ToOwned::to_owned))
+		ready(auth_events.get(&key).map(ToOwned::to_owned))
 	};

 	let auth_check = state_res::event_auth::auth_check(
@@ -5,9 +5,9 @@

 use std::time::Duration;

-use conduwuit::{Err, Event, PduEvent, Result, debug, debug_info, implement, trace, warn};
+use conduwuit::{Err, Event, PduEvent, Result, debug, implement, warn};
 use ruma::{
-	CanonicalJsonObject, RoomId, ServerName,
+	RoomId, ServerName,
 	api::federation::room::policy::v1::Request as PolicyRequest,
 	events::{StateEventType, room::policy::RoomPolicyEventContent},
 };
@@ -25,12 +25,7 @@ use ruma::{
 /// fail-open operation.
 #[implement(super::Service)]
 #[tracing::instrument(skip_all, level = "debug")]
-pub async fn ask_policy_server(
-	&self,
-	pdu: &PduEvent,
-	pdu_json: &CanonicalJsonObject,
-	room_id: &RoomId,
-) -> Result<bool> {
+pub async fn ask_policy_server(&self, pdu: &PduEvent, room_id: &RoomId) -> Result<bool> {
 	if *pdu.event_type() == StateEventType::RoomPolicy.into() {
 		debug!(
 			room_id = %room_id,
@@ -52,12 +47,12 @@ pub async fn ask_policy_server(
 	let via = match policyserver.via {
 		| Some(ref via) => ServerName::parse(via)?,
 		| None => {
-			trace!("No policy server configured for room {room_id}");
+			debug!("No policy server configured for room {room_id}");
 			return Ok(true);
 		},
 	};
 	if via.is_empty() {
-		trace!("Policy server is empty for room {room_id}, skipping spam check");
+		debug!("Policy server is empty for room {room_id}, skipping spam check");
 		return Ok(true);
 	}
 	if !self.services.state_cache.server_in_room(via, room_id).await {
@@ -71,12 +66,12 @@ pub async fn ask_policy_server(
 	let outgoing = self
 		.services
 		.sending
-		.convert_to_outgoing_federation_event(pdu_json.clone())
+		.convert_to_outgoing_federation_event(pdu.to_canonical_object())
 		.await;
-	debug_info!(
+	debug!(
 		room_id = %room_id,
 		via = %via,
-		outgoing = ?pdu_json,
+		outgoing = ?outgoing,
 		"Checking event for spam with policy server"
 	);
 	let response = tokio::time::timeout(
@@ -90,10 +85,7 @@ pub async fn ask_policy_server(
 	)
 	.await;
 	let response = match response {
-		| Ok(Ok(response)) => {
-			debug!("Response from policy server: {:?}", response);
-			response
-		},
+		| Ok(Ok(response)) => response,
 		| Ok(Err(e)) => {
 			warn!(
 				via = %via,
@@ -105,18 +97,16 @@ pub async fn ask_policy_server(
 			// default.
 			return Err(e);
 		},
-		| Err(elapsed) => {
+		| Err(_) => {
 			warn!(
-				%via,
+				via = %via,
 				event_id = %pdu.event_id(),
-				%room_id,
-				%elapsed,
+				room_id = %room_id,
 				"Policy server request timed out after 10 seconds"
 			);
 			return Err!("Request to policy server timed out");
 		},
 	};
-	trace!("Recommendation from policy server was {}", response.recommendation);
 	if response.recommendation == "spam" {
 		warn!(
 			via = %via,
@@ -255,10 +255,7 @@ where
 		// 14-pre. If the event is not a state event, ask the policy server about it
 		if incoming_pdu.state_key.is_none() {
 			debug!(event_id = %incoming_pdu.event_id, "Checking policy server for event");
-			match self
-				.ask_policy_server(&incoming_pdu, &incoming_pdu.to_canonical_object(), room_id)
-				.await
-			{
+			match self.ask_policy_server(&incoming_pdu, room_id).await {
 				| Ok(false) => {
 					warn!(
 						event_id = %incoming_pdu.event_id,
@@ -1,10 +1,9 @@
-use conduwuit::{Err, Result, RoomVersion, implement, matrix::Event, pdu::PduBuilder};
+use conduwuit::{Err, Result, implement, matrix::Event, pdu::PduBuilder};
 use ruma::{
 	EventId, RoomId, UserId,
 	events::{
 		StateEventType, TimelineEventType,
 		room::{
-			create::RoomCreateEventContent,
 			history_visibility::{HistoryVisibility, RoomHistoryVisibilityEventContent},
 			member::{MembershipState, RoomMemberEventContent},
 			power_levels::{RoomPowerLevels, RoomPowerLevelsEventContent},
@@ -45,23 +44,6 @@ pub async fn user_can_redact(
 		)));
 	}

-	let room_create = self
-		.room_state_get(room_id, &StateEventType::RoomCreate, "")
-		.await?;
-	let create_content: RoomCreateEventContent =
-		serde_json::from_str(room_create.content().get())?;
-	let room_features = RoomVersion::new(&create_content.room_version)?;
-	if room_features.explicitly_privilege_room_creators {
-		let sender_owned = sender.to_owned();
-		if sender == room_create.sender()
-			|| create_content
-				.additional_creators
-				.is_some_and(|cs| cs.contains(&sender_owned))
-		{
-			return Ok(true);
-		}
-	}
-
 	match self
 		.room_state_get_content::<RoomPowerLevelsEventContent>(
 			room_id,
@@ -86,10 +68,18 @@ pub async fn user_can_redact(
 		},
 		| _ => {
 			// Falling back on m.room.create to judge power level
-			Ok(room_create.sender() == sender
-				|| redacting_event
-					.as_ref()
-					.is_ok_and(|redacting_event| redacting_event.sender() == sender))
+			match self
+				.room_state_get(room_id, &StateEventType::RoomCreate, "")
+				.await
+			{
+				| Ok(room_create) => Ok(room_create.sender() == sender
+					|| redacting_event
+						.as_ref()
+						.is_ok_and(|redacting_event| redacting_event.sender() == sender)),
+				| _ => Err!(Database(
+					"No m.room.power_levels or m.room.create events in database for room"
+				)),
+			}
 		},
 	}
 }
@@ -9,7 +9,6 @@ use conduwuit_core::{
 		state_res::{self, RoomVersion},
 	},
 	utils::{self, IterStream, ReadyExt, stream::TryIgnore},
-	warn,
 };
 use futures::{StreamExt, TryStreamExt, future, future::ready};
 use ruma::{
@@ -20,6 +19,7 @@ use ruma::{
 	uint,
 };
 use serde_json::value::{RawValue, to_raw_value};
+use tracing::warn;

 use super::RoomMutexGuard;

@@ -267,33 +267,11 @@ pub async fn create_hash_and_sign_event(
 			| _ => Err!(Request(Unknown(warn!("Signing event failed: {e}")))),
 		};
 	}
-	// Check with the policy server
+
 	// Generate event id
 	pdu.event_id = gen_event_id(&pdu_json, &room_version_id)?;
+
 	pdu_json.insert("event_id".into(), CanonicalJsonValue::String(pdu.event_id.clone().into()));
-	if room_id.is_some() {
-		trace!(
-			"Checking event in room {} with policy server",
-			pdu.room_id.as_ref().map_or("None", |id| id.as_str())
-		);
-		match self
-			.services
-			.event_handler
-			.ask_policy_server(&pdu, &pdu_json, pdu.room_id().expect("has room ID"))
-			.await
-		{
-			| Ok(true) => {},
-			| Ok(false) => {
-				return Err!(Request(Forbidden(debug_warn!(
-					"Policy server marked this event as spam"
-				))));
-			},
-			| Err(e) => {
-				// fail open
-				warn!("Failed to check event with policy server: {e}");
-			},
-		}
-	}

 	// Check with the policy server
 	if room_id.is_some() {
@@ -305,7 +283,7 @@ pub async fn create_hash_and_sign_event(
 		match self
 			.services
 			.event_handler
-			.ask_policy_server(&pdu, &pdu_json, &pdu.room_id_or_hash())
+			.ask_policy_server(&pdu, &pdu.room_id_or_hash())
 			.await
 		{
 			| Ok(true) => {},
Author	SHA1	Message	Date
Jade Ellis	9d0c89bd04	fix(v12): Create tombstone event on room upgrade	2025-09-24 18:22:16 +00:00
nexy7574	965db4aa43	fix: V12 room upgrades	2025-09-24 18:22:16 +00:00
Renovate Bot	472e1fee17	chore(deps): update ghcr.io/renovatebot/renovate docker tag to v41.127.2	2025-09-24 05:03:46 +00:00
Jade Ellis	3c6f2d07e0	ci: Only run RPM builds on tags or schedule	2025-09-23 22:16:46 +01:00
ginger	43254aa396	fix: Attempt to enable RPM signing	2025-09-23 22:15:01 +01:00
Tom Foster	48ebf86335	feat(ci): Add Fedora RPM package build workflow Build and publish RPM packages for Fedora using rpkg and official rust-packaging macros. Packages are automatically signed by Forgejo's built-in package registry (introduced in v9.0). Publishes packages to organised groups: - continuwuity (binary): base group (stable/dev/branch-name) - continuwuity-debuginfo: GROUP-debug - continuwuity (source RPM): GROUP-src Workflow triggers on pushes to relevant paths and version tags (v*). Tagged releases use clean version numbers (v1.2.3 becomes 1.2.3-1) while branch builds use sanitised branch name versioning. Uses dnf builddep to install build dependencies directly from the generated SRPM, ensuring consistency between CI and spec file without duplication. This also prevents hiding packaging issues that could occur with --nodeps fallbacks.	2025-09-23 22:15:00 +01:00
Ginger	f1e3b4907e	Build Debian packages and upload them to Forgejo's repository (#996 ) This uses the existing `cargo-deb` metadata. Reviewed-on: https://forgejo.ellis.link/continuwuation/continuwuity/pulls/996 Reviewed-by: Tom Foster <tom@tcpip.uk> Reviewed-by: nex <nex@noreply.forgejo.ellis.link> Co-authored-by: Ginger <ginger@gingershaped.computer> Co-committed-by: Ginger <ginger@gingershaped.computer>	2025-09-23 19:53:37 +00:00
Jade Ellis	9346a0d05e	fix(ci): Typo	2025-09-23 12:55:04 +01:00
nyanbinary	c99faae115	chore(nix): bump rocksdb version in flake.nix to 10.5.fb	2025-09-23 06:31:10 +00:00
Renovate Bot	a5aa68ee8d	chore(deps): update ghcr.io/renovatebot/renovate docker tag to v41.125.2	2025-09-23 03:53:03 +00:00
Tom Foster	8959ac06ac	ci: Split Rust build cache into dependencies and incremental caches Replace single large build cache with separate dependencies and incremental caches. Dependencies cache survives source code changes and uses tiered restore keys. Removes build directory from caching to improve CI performance while maintaining effective compilation caching with sccache.	2025-09-23 04:30:35 +01:00
Tom Foster	47f7ebfd68	fix: Use node_version in npm cache key for wrangler installation Replace hashFiles('**/package-lock.json') with node_version since wrangler is installed via npm without a lockfile to hash. Removes trailing dash from cache keys and ensures npm dependencies are regenerated when Node.js version changes.	2025-09-23 04:30:35 +01:00
Tom Foster	7d91f218b1	ci: Migrate to detect-versions with namespaced cache keys Replace local detect-runner-os action with external detect-versions@v1 to reduce custom action maintenance. Add architecture detection for future cross-platform support and namespace all cache keys with "continuwuity-" prefix to prevent collisions with other projects on shared runners. Updates cache mount IDs in Dockerfiles to match the new namespacing convention, ensuring consistent cache isolation across CI and Docker builds.	2025-09-23 04:30:22 +01:00
Jade Ellis	e5e2db37d9	ci: Run image release workflow on tag	2025-09-22 17:03:26 +01:00
Jade Ellis	e08ea3b9e5	ci: Trace commands to push docker manifests	2025-09-22 17:03:26 +01:00
Jade Ellis	4f1907abfa	ci: Change tag generation to use suffix flavour	2025-09-22 17:03:26 +01:00
Ginger	92d74c293e	feat: Advertise support for MSC4155	2025-09-22 11:33:45 -04:00
Renovate Bot	3fbdced0e1	chore(deps): update github-actions-non-major	2025-09-22 05:04:03 +00:00