[FIX] driver: a failed clone rebuilt the package before it

libselinux does not exist in Arch, so its clone 404'd. GitLab answers a
404 by asking for credentials, which is why the log read "could not read
Username" rather than "no such project" -- the first wrong culprit.

The second was mine. Neither the clone nor the cd that follows it was
guarded, so makepkg ran in whatever directory the previous package had
left. It rebuilt util-linux, wrote 119 KB of util-linux output into
log-libselinux.txt, and copied the artefact back into the repository.

The lesson is the repository's oldest one, one level up: an exit code
proves nothing, and neither does a log file's name. Verified by checking
every log against the "==> Making package:" line inside it.

--- FR ---

libselinux n'existe pas dans Arch, son clone a donc rendu un 404. GitLab
répond à un 404 en réclamant des identifiants : d'où le « could not read
Username » du journal, plutôt qu'un « projet inconnu ». Premier faux
coupable.

Le second était de mon fait. Ni le clone ni le cd qui le suit n'étaient
gardés, alors makepkg tournait dans le répertoire laissé par le paquet
précédent. Il a reconstruit util-linux, versé 119 ko de sortie util-linux
dans log-libselinux.txt, puis recopié l'artefact dans le dépôt.

La leçon est la plus ancienne du dépôt, d'un cran plus haut : un code de
sortie ne prouve rien, et le NOM d'un journal non plus. Vérifié en
confrontant chaque journal à la ligne « ==> Making package: » qu'il porte.

Assisted-by: Claude Opus 5

scripts/bootstrap-pacman.sh

@@ -53,7 +53,7 @@ build_pacman() {
     log "pacman + makepkg + repo-add"
     mkdir -p "$WORK"
     [ -d "$WORK/pacman" ] || git clone --depth 1 "$PACMAN_GIT" "$WORK/pacman"
-    cd "$WORK/pacman"
+    cd "$WORK/pacman" || return 1
     # /usr/local, never /usr: this host is Ubuntu and /usr belongs to dpkg.
     # makepkg resolves its own libraries from the configured prefix, so the
     # prefix has to be real -- running it from the build tree fails with
@@ -121,9 +121,31 @@ build_package() {
     local name="$1"
     log "Building $name"
     mkdir -p "$WORK/pkg"
-    [ -d "$WORK/pkg/$name" ] || \
-        git clone --depth 1 "$PKG_GIT_BASE/$name.git" "$WORK/pkg/$name"
-    cd "$WORK/pkg/$name"
+    # Both guards are load-bearing, and their absence cost a whole run.
+    #
+    # gitlab.archlinux.org answers a 404 by asking for credentials, so a
+    # package that does not exist fails as
+    #
+    #   fatal: could not read Username for 'https://gitlab.archlinux.org'
+    #
+    # GIT_TERMINAL_PROMPT=0 turns that into an immediate error instead of a
+    # process waiting on a terminal that is not there.
+    #
+    # Then the cd. With neither guarded, a failed clone left makepkg running
+    # in whatever directory the PREVIOUS package used -- it rebuilt that
+    # package, wrote the output into THIS package's log, and copied the
+    # artefact back into the repository. log-libselinux.txt was 119 KB of
+    # util-linux. The lesson is the repository's oldest one, one level up:
+    # an exit code proves nothing, and neither does a log file's NAME.
+    if [ ! -d "$WORK/pkg/$name" ]; then
+        GIT_TERMINAL_PROMPT=0 \
+            git clone --depth 1 "$PKG_GIT_BASE/$name.git" "$WORK/pkg/$name" || {
+            rm -rf "$WORK/pkg/$name"
+            echo "clone failed: $PKG_GIT_BASE/$name.git" >&2
+            return 1
+        }
+    fi
+    cd "$WORK/pkg/$name" || return 1
     # Port patches. Upstream PKGBUILDs are written for x86_64 and some carry
     # flags no other architecture accepts -- glibc's --enable-sframe is the
     # first. They are applied here, one hook per package, so each change is