feat!: rebrand unit→freeunit and parametrize brand identity

Upstream rebranded its packages and on-disk identity from unit* to
freeunit* (daemon freeunitd, /var/lib/freeunit, control.freeunit.sock,
the freeunit:freeunit user/group). Since this image only installs the
prebuilt .deb artifacts, that identity is fixed by the artifact — so the
download/verify/install names, the runtime paths, and the default app
user/group all move to freeunit, and FREEUNIT_VERSION/FREEUNIT_RELEASE
bump to 1.35.6-1 / 1.35.6-build2 with a recomputed SHA256SUMS anchor.

To document intent without making identity a free knob, a brand ARG
group (BRAND/RUNTIME/RUNDIR/BRAND_TITLE/HOMEPAGE/DOCS_URL) mirrors the
upstream packaging vocabulary and feeds RUN/LABEL only; a build-time
guard then asserts the installed ${RUNTIME}d's compiled paths match, so
a future upstream identity change fails the build instead of shipping an
image whose entrypoint manages the wrong paths.

The default launch moves out of CMD into docker-entrypoint.sh and the
HEALTHCHECK becomes docker-healthcheck.sh, because an exec-form
CMD/HEALTHCHECK cannot expand a build ARG/ENV — keeping the binary name
and control-socket path single-sourced from the entrypoint library
rather than duplicated in the Dockerfile.

BREAKING CHANGE: config snippets must set "user"/"group": "freeunit"
(was "unit"); the state dir is /var/lib/freeunit and the control socket
control.freeunit.sock; APPLICATION_USER/APPLICATION_GROUP default to
freeunit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: 6RUN0

.github/workflows/check-upstream.yml

@@ -80,17 +80,19 @@ jobs:
 
           # New deb version comes from the core asset name. GitHub renames the
           # '~' to '.' in download URLs, but SHA256SUMS keeps the real '~' name:
-          #   unit_<version>~<suite>_amd64.deb
-          core=$(grep -oE "unit_[^ ]+~${suite}_amd64\.deb" "$work/SHA256SUMS" | head -n1)
-          : "${core:?no core unit_*~${suite}_amd64.deb entry in SHA256SUMS}"
-          new_version=${core#unit_}
+          #   freeunit_<version>~<suite>_amd64.deb
+          # The '_' right after the brand isolates the core from the hyphenated
+          # siblings (freeunit-dev_, freeunit-php8.3_, freeunit-dbg_, ...).
+          core=$(grep -oE "freeunit_[^ ]+~${suite}_amd64\.deb" "$work/SHA256SUMS" | head -n1)
+          : "${core:?no core freeunit_*~${suite}_amd64.deb entry in SHA256SUMS}"
+          new_version=${core#freeunit_}
           new_version=${new_version%"~${suite}_amd64.deb"}
           : "${new_version:?could not parse the deb version from $core}"
 
           # Refuse to bump to an incomplete release: every matrixed PHP line must
           # have its module .deb checksummed, or the build would fail later.
           for php in $PHP_LINES; do
-            entry="unit-php${php}_${new_version}~${suite}_amd64.deb"
+            entry="freeunit-php${php}_${new_version}~${suite}_amd64.deb"
             grep -qF "$entry" "$work/SHA256SUMS" \
               || { echo "ERROR: release $new_release has no entry for $entry" >&2; exit 1; }
           done

CHANGELOG.md

@@ -10,6 +10,31 @@ release records the FreeUnit and PHP versions it ships.
 
 ## [Unreleased]
 
+### Changed
+
+- **FreeUnit rebrand (breaking for downstream images).** Upstream renamed its
+  Debian packages and on-disk identity from `unit*` to `freeunit*`, and the image
+  follows suit: the daemon is `freeunitd`/`freeunitd-debug`, the state dir
+  `/var/lib/freeunit`, the control socket `/var/run/control.freeunit.sock`, the log
+  `/var/log/freeunit.log`, and the default application user/group `freeunit` (was
+  `unit`). Downstream images must move any `config.json` `user`/`group` keys and
+  any custom launch command from `unit`/`unitd` to `freeunit`/`freeunitd`; the
+  reusable entrypoint library keeps its function names and `UNIT_*`/`APPLICATION_*`
+  variable identifiers, so hooks that only call the documented API are unaffected.
+- Bumped the bundled FreeUnit `.deb` release to `1.35.6-build2` (`1.35.6-1`) and
+  recomputed the `FREEUNIT_SHA256SUMS_SHA256` trust anchor.
+- The brand identity is single-sourced as Dockerfile `ARG`s mirroring the upstream
+  packaging vocabulary (`BRAND`, `RUNTIME`, `RUNDIR`, `BRAND_TITLE`, `HOMEPAGE`,
+  `DOCS_URL`). They default to `freeunit`/`/var/run` and the build now **asserts the
+  installed binary's compiled paths match `RUNTIME`/`RUNDIR`**, so a future upstream
+  identity change fails the build instead of shipping an image whose entrypoint
+  manages paths the daemon does not use.
+- The default launch command moved out of the Dockerfile `CMD` into the entrypoint,
+  and the `HEALTHCHECK` is now a script (`/docker-healthcheck.sh`), so the binary
+  name and control-socket path stay single-sourced from `docker-entrypoint-common.sh`
+  instead of being duplicated in an exec-form instruction that cannot expand a
+  build ARG.
+
 ## [0.0.5] - 2026-06-09
 
 ### Added

CHANGELOG.ru.md

@@ -10,6 +10,31 @@
 
 ## [Не выпущено]
 
+### Изменено
+
+- **Ребрендинг FreeUnit (ломающее изменение для дочерних образов).** Апстрим
+  переименовал Debian-пакеты и идентичность на диске с `unit*` на `freeunit*`, и
+  образ следует за ним: демон — `freeunitd`/`freeunitd-debug`, каталог состояния —
+  `/var/lib/freeunit`, управляющий сокет — `/var/run/control.freeunit.sock`, лог —
+  `/var/log/freeunit.log`, пользователь/группа приложения по умолчанию — `freeunit`
+  (было `unit`). Дочерние образы должны заменить ключи `user`/`group` в
+  `config.json` и любую кастомную команду запуска с `unit`/`unitd` на
+  `freeunit`/`freeunitd`; библиотека entrypoint сохраняет имена функций и
+  идентификаторы переменных `UNIT_*`/`APPLICATION_*`, поэтому хуки, использующие
+  только документированный API, не затронуты.
+- Версия встроенного релиза FreeUnit `.deb` поднята до `1.35.6-build2` (`1.35.6-1`),
+  пересчитан якорь доверия `FREEUNIT_SHA256SUMS_SHA256`.
+- Идентичность бренда вынесена в единый источник — `ARG` в `Dockerfile`,
+  повторяющие словарь апстрим-упаковки (`BRAND`, `RUNTIME`, `RUNDIR`, `BRAND_TITLE`,
+  `HOMEPAGE`, `DOCS_URL`). По умолчанию `freeunit`/`/var/run`, и сборка теперь
+  **проверяет, что вкомпилированные пути установленного бинаря совпадают с
+  `RUNTIME`/`RUNDIR`**, поэтому смена идентичности в апстриме уронит сборку, а не
+  выпустит образ, чей entrypoint управляет не теми путями.
+- Команда запуска по умолчанию перенесена из `CMD` в `Dockerfile` в entrypoint, а
+  `HEALTHCHECK` стал скриптом (`/docker-healthcheck.sh`), чтобы имя бинаря и путь
+  управляющего сокета оставались в едином источнике (`docker-entrypoint-common.sh`),
+  а не дублировались в инструкции exec-формы, которая не раскрывает build ARG.
+
 ## [0.0.5] - 2026-06-09
 
 ### Добавлено

CLAUDE.md

@@ -23,10 +23,16 @@ embedded PHP language module on Debian **trixie** (amd64). The whole
 php-version / suite / FreeUnit-release matrix is covered by build args — there
 is no code generation and no committed per-variant directories.
 
-FreeUnit ships **prebuilt `.deb` packages** (core `unit` + per-version
-`unit-phpX.Y` modules) on its GitHub releases page, so the build installs them
+FreeUnit ships **prebuilt `.deb` packages** (core `freeunit` + per-version
+`freeunit-phpX.Y` modules) on its GitHub releases page, so the build installs them
 directly — it does **not** compile Unit or the PHP module from source.
 
+Upstream rebranded its packages and on-disk identity from `unit*` to `freeunit*`
+(daemon `freeunitd`, `/var/lib/freeunit`, `control.freeunit.sock`, the
+`freeunit:freeunit` user/group). Because this image only *installs* the prebuilt
+`.deb`s, that identity is fixed by the artifact, not chosen here — see the brand
+ARGs and the build-time guard below.
+
 ## Build matrix
 
 The `Makefile` drives the matrix; each target is one `docker build` with
@@ -41,15 +47,25 @@ docker build --build-arg PHP_VER=8.3 -t x .         # one-off without make
 ```
 
 Key build args (defaults in the `Dockerfile`): `PHP_VER` (8.4), `SUITE` (trixie),
-`IMAGE_SUFFIX` (-slim), `FREEUNIT_VERSION` (deb version base, e.g. `1.35.5-1`),
-`FREEUNIT_RELEASE` (GitHub release tag, e.g. `1.35.5-build4`), and the
+`IMAGE_SUFFIX` (-slim), `FREEUNIT_VERSION` (deb version base, e.g. `1.35.6-1`),
+`FREEUNIT_RELEASE` (GitHub release tag, e.g. `1.35.6-build2`), and the
 `DEBIAN_MIRROR` / `DEBIAN_SECURITY_MIRROR` / `SURY_MIRROR` mirror args (neutral
 CDN defaults; sury is fetched over https because its signing key travels that
 channel). The `Makefile` reads `SUITE` / `PHP_VER` / `FREEUNIT_VERSION` /
 `FREEUNIT_RELEASE` defaults out of the `Dockerfile` ARGs via `sed`, so they are
 **single-sourced**: bumping a FreeUnit release = edit `FREEUNIT_VERSION` +
 `FREEUNIT_RELEASE` in the `Dockerfile` only (or pass on the command line).
 
+A second ARG group single-sources the **brand identity**, mirroring the upstream
+packaging vocabulary (`freeunit/pkg/deb/Makefile`): `BRAND` (dpkg/apt asset and
+package names we download), `RUNTIME` (the on-disk identity compiled into the
+package — binary `${RUNTIME}d`, `/var/lib/${RUNTIME}`, `control.${RUNTIME}.sock`,
+`/var/log/${RUNTIME}.log`, the `${RUNTIME}:${RUNTIME}` user/group), `RUNDIR` (the
+socket + pid dir), plus `BRAND_TITLE` / `HOMEPAGE` / `DOCS_URL` for the OCI labels.
+All default to `freeunit` / `/var/run`. These are **not** free knobs (the prebuilt
+`.deb`s carry one fixed identity); they document intent and are asserted against
+the installed binary at build time (see below).
+
 The Makefile's immutable image tag is `$(SUITE)-$(FREEUNIT_RELEASE)-php$*` (the
 release is the unique build id), plus the floating `$(SUITE)-php$*`.
 
@@ -65,25 +81,34 @@ release is the unique build id), plus the floating `$(SUITE)-php$*`.
 3. **php_image** also installs the fragile extensions (`imagick`,
    `uploadprogress`) in a **best-effort** loop (`apt-get install … || echo
    WARNING`), so a missing extension on a newer PHP line does not fail the build.
-4. **final_image** — downloads `unit_*` and `unit-php${PHP_VER}_*` `.deb`s from the
-   FreeUnit GitHub release, verifies `SHA256SUMS` itself against the pinned
+4. **final_image** — downloads `${BRAND}_*` and `${BRAND}-php${PHP_VER}_*` `.deb`s
+   from the FreeUnit GitHub release, verifies `SHA256SUMS` itself against the pinned
    `FREEUNIT_SHA256SUMS_SHA256` trust anchor (see below), then verifies the `.deb`s
    against it (asserting both expected entries are present with `grep -qF`, so
    `--ignore-missing` cannot pass vacuously), and `apt-get install`s the two local
    files (apt pulls
-   `libphp${PHP_VER}-embed` already present and the virtual `unit-rX.Y.Z` provided
-   by the core package). Then it prepares `/var/lib/unit` + `/docker-entrypoint.d`,
-   symlinks `unit.log` to stdout, `COPY rootfs/ /`, sets OCI `LABEL`s, and sets the
-   `tini` entrypoint + `unitd --no-daemon`.
+   `libphp${PHP_VER}-embed` already present and the virtual `${RUNTIME}-rX.Y.Z`
+   provided by the core package). Then it prepares `/var/lib/${RUNTIME}` +
+   `/docker-entrypoint.d`, symlinks `/var/log/${RUNTIME}.log` to stdout, **asserts
+   the installed `${RUNTIME}d`'s compiled paths (`--statedir`/`--control`/`--pid`/
+   `--log`/`--user`/`--group` from its `--version` configure line) match
+   `RUNTIME`/`RUNDIR`** — so a future upstream identity change fails the build
+   instead of shipping an image whose entrypoint manages the wrong paths — then
+   `COPY rootfs/ /` and sets OCI `LABEL`s. There is **no `CMD`**: the default launch
+   (`${RUNTIME}d --no-daemon --control …`) lives in the entrypoint and the
+   `HEALTHCHECK` is a script (`/docker-healthcheck.sh`), so the binary name and
+   socket path stay single-sourced from `docker-entrypoint-common.sh` rather than
+   duplicated in an exec-form instruction (which cannot expand a build ARG/ENV).
+   `tini` is the entrypoint wrapper.
 
 `SUITE` and `IMAGE_SUFFIX` are declared **before the first `FROM`** so they reach
 the `FROM` line; they are re-declared inside stages that use them in `RUN`.
 
 ### Critical packaging detail (asset name vs deb version)
 
 GitHub renames the `~` in deb version strings to `.` in asset file names, so the
-**same** package is downloaded as `unit_1.35.5-1.trixie_amd64.deb` but its real
-version (and its `SHA256SUMS` entry) is `1.35.5-1~trixie`. The Dockerfile downloads
+**same** package is downloaded as `freeunit_1.35.6-1.trixie_amd64.deb` but its real
+version (and its `SHA256SUMS` entry) is `1.35.6-1~trixie`. The Dockerfile downloads
 with `curl -o` into the **`~` name** so `sha256sum -c --ignore-missing` actually
 matches the file. Saving under the `.` name would make the checksum check pass
 **vacuously** (no matching filename → entry skipped) — a silent integrity hole.
@@ -96,8 +121,8 @@ trusted `SHA256SUMS` **in version control**, and the build aborts unless the
 fetched file hashes to it. Bumping FreeUnit therefore means recomputing this
 digest too — which is exactly what `check-upstream.yml` automates.
 
-The core `unit` package's `postinst` creates the `unit:unit` system user/group,
-so the Dockerfile does not create it manually.
+The core `freeunit` package's `postinst` creates the `freeunit:freeunit` system
+user/group, so the Dockerfile does not create it manually.
 
 ## rootfs overlay
 
@@ -110,12 +135,15 @@ lives there at its target path:
   library): if a sourced file defined a shell function `handle_<cmd>` matching
   `$1`, that handler owns the launch (it must `exec`, and a return or a non-zero
   exit is a fatal contract violation);
-  otherwise, for `unitd`/`unitd-debug` it runs the standard first-run routine
-  (`unit_initial_configuration`) and `exec`s the command. The first-run routine
-  only fires when `/var/lib/unit` is empty: it launches unitd against the control
-  socket and applies everything in `/docker-entrypoint.d/` (`*.sh` executed,
+  otherwise, for `freeunitd`/`freeunitd-debug` it runs the standard first-run
+  routine (`unit_initial_configuration`) and `exec`s the command. (When invoked
+  with no command at all, the dispatcher first supplies the default launch —
+  `${UNIT_BINARY} --no-daemon --control …` — from the `UNIT_*` constants, so the
+  image needs no `CMD`.) The first-run routine
+  only fires when `/var/lib/freeunit` is empty: it launches freeunitd against the
+  control socket and applies everything in `/docker-entrypoint.d/` (`*.sh` executed,
   `*.pem` uploaded as certificate bundles, `*.json` PUT to `config`), then stops
-  unitd so the real start boots a populated state.
+  freeunitd so the real start boots a populated state.
 - `rootfs/docker-entrypoint-common.sh` — the reusable **core library** sourced by
   the entrypoint (and available to child hooks). Every function takes its target
   as an argument, defaulting to the `UNIT_*` / `ENTRYPOINT_*` constants, so a
@@ -144,8 +172,14 @@ lives there at its target path:
     idempotent; a child hook calls it to create a *different* app user.
   - `unit_initial_configuration <binary>` is the full first-run routine composed
     from the above, guarded by its `unit_config_failed` EXIT trap.
-  On source it provisions the default app user from `APPLICATION_USER/UID/GROUP/
-  GID/DIR/CHOWN` by calling `setup_user` with them.
+  On source it provisions the default app user (default `freeunit`, which maps to
+  the package's system `freeunit:freeunit`) from `APPLICATION_USER/UID/GROUP/
+  GID/DIR/CHOWN` by calling `setup_user` — unless `UNIT_LIB_NO_PROVISION=1` is set,
+  which yields the constants/functions without the side effect (used by
+  `/docker-healthcheck.sh`, which sources the lib only to read `UNIT_CONTROL_SOCKET`).
+  The path constants derive from `UNIT_RUNTIME` (`freeunit`) and `UNIT_RUNDIR`
+  (`/var/run`), readonly literals — deliberately not env-derived — so the state-dir
+  wipe target and control paths cannot be redirected at runtime.
 
 `/docker-entrypoint.d` itself is created by the `RUN` (empty dirs are not tracked
 in git); users mount or add config snippets into it at runtime.
@@ -179,8 +213,9 @@ The two reusable routines above are the public surface handlers build on.
 
 ## Verification
 
-- **Build** — the `final_image` stage runs `unitd --version` and `php -v`, so a
-  successful build proves the daemon and module load.
+- **Build** — the `final_image` stage runs `freeunitd --version` (also asserting
+  its compiled paths match `RUNTIME`/`RUNDIR`) and `php -v`, so a successful build
+  proves the daemon and module load and the image's paths match the binary.
 - **Smoke test** — `test/smoke.sh <image-ref>` runs the image with the
   `test/fixtures/` PHP app mounted (config into `/docker-entrypoint.d`, code into
   `/www`) and asserts a request is served by PHP — the entrypoint's happy path.
@@ -237,4 +272,4 @@ The two reusable routines above are the public surface handlers build on.
   the build context.
 - The entrypoint uses bash globs (`shopt -s nullglob globstar`) over
   `/docker-entrypoint.d`, not `for f in $(find …)`; it passes `--pid` explicitly
-  and wipes `/var/lib/unit` if first-run config fails (retry on next start).
+  and wipes `/var/lib/freeunit` if first-run config fails (retry on next start).