From db67e0109ff17fcbc5aff1942d17987c3dbd2657 Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Thu, 8 Oct 2026 09:43:53 -0400 Subject: [PATCH] Release: Windows arm64, Flatpak aarch64, AppImage zsync updates, README Downloads (#9) - Windows: add arm64 (aarch64-pc-windows-msvc) to the matrix. package.ps1, sign.ps1 and the WiX source already handled it; nothing in the dependency tree blocks the target (clippy -D warnings is clean for it). - Flatpak: x86_64 and aarch64 bundles repackage the Linux job's tarball (PhotoCraft's approach: same binaries and embedded fonts as the AppImage/deb/rpm, no Rust build). The from-source manifest stays for Flathub; packaging-lint keeps the two in sync. Both now grant --socket=pulseaudio so slide-show audio/video plays in the sandbox. - AppImage: embed gh-releases-zsync update information and publish the .zsync beside it. - Jobs that sign nothing (version, linux, flatpak, freebsd, web) leave the release environment, so a branch dispatch is a dry run; the draft-release job now requires every build. - README: Downloads section. Co-authored-by: Brandon Thomas Co-authored-by: Claude Opus 5.5 --- .github/workflows/packaging-lint.yml | 11 +- .github/workflows/release.yml | 111 ++++++++---------- README.md | 45 +++++++ packaging/linux/flatpak-bundle.sh | 72 ++++++++++++ .../ai.storyteller.deckcraft.bundle.yml | 51 ++++++++ .../flatpak/ai.storyteller.deckcraft.yml | 19 ++- packaging/linux/package.sh | 30 ++++- 7 files changed, 268 insertions(+), 71 deletions(-) create mode 100755 packaging/linux/flatpak-bundle.sh create mode 100644 packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml diff --git a/.github/workflows/packaging-lint.yml b/.github/workflows/packaging-lint.yml index e3919d9..96eb5b9 100644 --- a/.github/workflows/packaging-lint.yml +++ b/.github/workflows/packaging-lint.yml @@ -54,4 +54,13 @@ jobs: desktop-file-validate packaging/linux/ai.storyteller.deckcraft.desktop sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' packaging/linux/ai.storyteller.deckcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.deckcraft.metainfo.xml" appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.deckcraft.metainfo.xml" - python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.deckcraft.yml')); assert m['id'] == 'ai.storyteller.deckcraft' and m['command'] == 'deckcraft'" + python3 - <<'EOF' + import yaml + src = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.deckcraft.yml")) + bundle = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml")) + for m in (src, bundle): + assert m["id"] == "ai.storyteller.deckcraft" and m["command"] == "deckcraft", m["id"] + for key in ("runtime", "runtime-version", "sdk", "finish-args"): + assert src[key] == bundle[key], f"Flatpak manifests disagree on {key}: {src[key]} vs {bundle[key]}" + print("Flatpak manifests ok") + EOF diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 70c235b..d3ef43d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,9 +6,11 @@ # `cargo xtask version set X.Y.Z`). The app shows it in About and `--version`; the release name # and tag use it too. workflow_dispatch can override it for a test build (applied to the build). # -# All jobs run in the `release` environment (restricted to the `release` branch), which holds -# the signing secrets. Every secret is optional: missing ones produce unsigned artifacts and a -# warning, never a failed build. +# The jobs that sign (macOS, Windows) and the one that drafts the release run in the `release` +# environment (restricted to the `release` branch), which holds the signing secrets. Every secret +# is optional: missing ones produce unsigned artifacts and a warning, never a failed build. The +# other jobs sign nothing and get no secrets, so a workflow_dispatch from another branch is a dry +# run: they build, the signed jobs are refused by the environment, and no release is drafted. name: Release on: @@ -42,11 +44,8 @@ env: jobs: version: name: version - # Only the release branch builds (a manual dispatch from any other ref skips everything). The - # branch itself is writable only by release-managers and org admins (ruleset "release"). - if: github.ref == 'refs/heads/release' runs-on: ubuntu-latest - environment: release + # No `environment: release`: no secrets needed, so branch dry runs get past it. outputs: version: ${{ steps.v.outputs.version }} date: ${{ steps.v.outputs.date }} @@ -131,6 +130,10 @@ jobs: include: - { arch: x64, target: x86_64-pc-windows-msvc } - { arch: x86, target: i686-pc-windows-msvc } + # Windows on ARM: cross-compiled on the x64 runner, so signing (x64 signtool / Azure + # Trusted Signing) and WiX (-arch arm64) run as above. package.ps1 checks the PE machine + # type and skips the CLI smoke test, since an ARM64 exe can't run on the x64 runner. + - { arch: arm64, target: aarch64-pc-windows-msvc } env: DECKCRAFT_VERSION: ${{ needs.version.outputs.version }} DECKCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }} @@ -181,7 +184,7 @@ jobs: # The oldest GitHub-hosted image, so the binaries only need glibc >= 2.35 (Ubuntu 22.04+, # Debian 12+, Fedora 36+, RHEL 10). runs-on: ${{ matrix.runner }} - environment: release + # No `environment: release`: this job signs nothing, so it gets no release secrets. strategy: fail-fast: false matrix: @@ -205,7 +208,7 @@ jobs: sudo apt-get update sudo apt-get install -y --no-install-recommends \ libasound2-dev libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev \ - desktop-file-utils appstream python3-yaml + desktop-file-utils appstream python3-yaml zsync curl -fsSL -o "$RUNNER_TEMP/nfpm.deb" \ "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${{ matrix.deb }}.deb" sudo dpkg -i "$RUNNER_TEMP/nfpm.deb" @@ -229,6 +232,9 @@ jobs: for appimage in dist/release/*.AppImage; do chmod +x "$appimage" APPIMAGE_EXTRACT_AND_RUN=1 "$appimage" --version + # Update information is embedded, and the .zsync for delta updates sits beside it. + "$appimage" --appimage-updateinformation | grep -F 'gh-releases-zsync|' + test -s "$appimage.zsync" done - uses: actions/upload-artifact@v4 with: @@ -236,67 +242,51 @@ jobs: path: dist/release/* if-no-files-found: error - flatpak-sources: - name: Flatpak crate sources - needs: version - runs-on: ubuntu-latest - environment: release - steps: - - uses: actions/checkout@v4 - - name: Vendor the crate sources (flatpak builds run offline) - run: | - python3 -m venv "$RUNNER_TEMP/venv" - "$RUNNER_TEMP/venv/bin/pip" install --quiet aiohttp tomlkit - curl -fsSL -o "$RUNNER_TEMP/flatpak-cargo-generator.py" \ - https://raw.githubusercontent.com/flatpak/flatpak-builder-tools/master/cargo/flatpak-cargo-generator.py - "$RUNNER_TEMP/venv/bin/python" "$RUNNER_TEMP/flatpak-cargo-generator.py" Cargo.lock -o cargo-sources.json - - uses: actions/upload-artifact@v4 - with: - name: flatpak-cargo-sources - path: cargo-sources.json - if-no-files-found: error - flatpak: - name: Linux Flatpak - needs: [version, flatpak-sources] - runs-on: ubuntu-latest - environment: release - # Best effort: Flathub builds from source itself (playbook §7); the bundle is a convenience. - continue-on-error: true - container: - image: ghcr.io/flathub-infra/flatpak-github-actions:freedesktop-25.08 - options: --privileged + name: Flatpak ${{ matrix.arch }} + needs: [version, linux] + # Repackages the Linux job's tarball (the same binaries as the AppImage/deb/rpm, with the + # craft-fonts embedded); no Rust build here. packaging/linux/flatpak/ai.storyteller.deckcraft.yml + # stays the from-source manifest for Flathub. 24.04 for a newer flatpak-builder (1.4) than + # 22.04 ships. + runs-on: ${{ matrix.runner }} + # No `environment: release`: this job signs nothing, so it gets no release secrets. + strategy: + fail-fast: false + matrix: + include: + - { arch: x86_64, runner: ubuntu-24.04 } + - { arch: aarch64, runner: ubuntu-24.04-arm } env: DECKCRAFT_VERSION: ${{ needs.version.outputs.version }} + DECKCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }} steps: - uses: actions/checkout@v4 - - name: Apply version override - if: inputs.version != '' - run: | - # No cargo in this container: the same edit `cargo xtask version set` makes. - sed -i "0,/^version = \".*\"/s//version = \"$DECKCRAFT_VERSION\"/" Cargo.toml - grep -m1 '^version' Cargo.toml - uses: actions/download-artifact@v4 with: - name: flatpak-cargo-sources - path: packaging/linux/flatpak - - uses: flatpak/flatpak-github-actions/flatpak-builder@v6 - with: - manifest-path: packaging/linux/flatpak/ai.storyteller.deckcraft.yml - bundle: deckcraft-${{ needs.version.outputs.version }}-linux-x86_64.flatpak - upload-artifact: false - cache-key: flatpak-builder-${{ github.sha }} + name: release-linux-${{ matrix.arch }} + path: dist/linux + - name: Install flatpak-builder + run: | + sudo apt-get update + # librsvg2-common: the SVG pixbuf loader. flatpak-builder runs the host's + # `appstreamcli compose`, which can fail without it. + sudo apt-get install -y --no-install-recommends flatpak flatpak-builder librsvg2-common + # Ubuntu 24.04's AppArmor blocks the unprivileged user namespaces bubblewrap needs. + sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 + - name: Build the Flatpak bundle + run: packaging/linux/flatpak-bundle.sh "dist/linux/deckcraft-$DECKCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz" - uses: actions/upload-artifact@v4 with: - name: release-flatpak - path: deckcraft-*.flatpak + name: release-flatpak-${{ matrix.arch }} + path: dist/release/*.flatpak if-no-files-found: error freebsd: name: FreeBSD x86_64 needs: version runs-on: ubuntu-latest - environment: release + # No `environment: release`: this job signs nothing, so it gets no release secrets. timeout-minutes: 240 env: DECKCRAFT_VERSION: ${{ needs.version.outputs.version }} @@ -330,6 +320,8 @@ jobs: export CARGO_TARGET_DIR="$HOME/target" CRAFT_FONTS_DIR="$PWD/craft-fonts" CRAFT_FONTS_REQUIRED=1 if [ -n "$VERSION_OVERRIDE" ]; then cargo xtask version set "$DECKCRAFT_VERSION"; fi bash packaging/freebsd/package.sh + tar -tzf dist/release/deckcraft-*-freebsd-x86_64.tar.gz \ + | grep -E '/bin/deckcraft$|/bin/deckcraft-cli$|/share/applications/ai\.storyteller\.deckcraft\.desktop$' - uses: actions/upload-artifact@v4 with: name: release-freebsd @@ -340,7 +332,7 @@ jobs: name: Web (wasm) needs: version runs-on: ubuntu-latest - environment: release + # No `environment: release`: this job signs nothing, so it gets no release secrets. env: DECKCRAFT_VERSION: ${{ needs.version.outputs.version }} DECKCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }} @@ -380,12 +372,9 @@ jobs: release: name: Draft GitHub Release + # Every build is required, so the draft always has the full set the README lists. Needing the + # signed jobs also keeps branch dry runs from drafting a release. needs: [version, macos, windows, linux, flatpak, freebsd, web] - # The installers are required; the Flatpak bundle and FreeBSD tarball are attached when they - # built. - if: >- - !cancelled() && needs.version.result == 'success' && needs.macos.result == 'success' && - needs.windows.result == 'success' && needs.linux.result == 'success' && needs.web.result == 'success' runs-on: ubuntu-latest environment: release permissions: diff --git a/README.md b/README.md index a462d67..fa673a8 100644 --- a/README.md +++ b/README.md @@ -51,6 +51,7 @@ Getting started · Agents, CLI and MCP · Roadmap · + Downloads · The Crafting Apps · License

@@ -125,6 +126,50 @@ roughly **80% of the way to a first alpha**. See [ROADMAP.md](ROADMAP.md) for th parity estimates and what's next, and [docs/parity.md](docs/parity.md) for the feature-by-feature scorecard. +## Downloads + +Every [release](https://github.com/storytold/deckcraft/releases/latest) ships these builds. `` is the +version number; `SHA256SUMS.txt` lists a checksum for every file. + +### macOS + +| Build | File | Notes | +|---|---|---| +| App, universal (Apple silicon + Intel) | `deckcraft--macos-universal.dmg` | Signed and notarized | +| Command-line tool, universal | `deckcraft-cli--macos-universal.zip` | Signed and notarized | + +### Windows + +| Build | Installer | Portable | +|---|---|---| +| x64 (64-bit Intel/AMD) | `deckcraft--windows-x64.msi` | `deckcraft--windows-x64-portable.zip` | +| arm64 (Snapdragon and other ARM PCs) | `deckcraft--windows-arm64.msi` | `deckcraft--windows-arm64-portable.zip` | +| x86 (32-bit) | `deckcraft--windows-x86.msi` | `deckcraft--windows-x86-portable.zip` | + +Installers and executables are code-signed. + +### Linux + +| Format | x86_64 | aarch64 (ARM64) | Notes | +|---|---|---|---| +| AppImage | `deckcraft--linux-x86_64.AppImage` | `deckcraft--linux-aarch64.AppImage` | Runs anywhere; updates itself with [AppImageUpdate](https://github.com/AppImageCommunity/AppImageUpdate) (`.zsync` files) | +| Flatpak | `deckcraft--linux-x86_64.flatpak` | `deckcraft--linux-aarch64.flatpak` | Sandboxed; `flatpak install --user ` | +| Debian/Ubuntu | `deckcraft--linux-x86_64.deb` | `deckcraft--linux-aarch64.deb` | | +| Fedora/RHEL/openSUSE | `deckcraft--linux-x86_64.rpm` | `deckcraft--linux-aarch64.rpm` | | +| Tarball | `deckcraft--linux-x86_64.tar.gz` | `deckcraft--linux-aarch64.tar.gz` | Unpack anywhere | + +### FreeBSD + +| Build | File | +|---|---| +| x86_64 | `deckcraft--freebsd-x86_64.tar.gz` | + +### Web (WebAssembly) + +| Build | File | Notes | +|---|---|---| +| Static site | `deckcraft-web-.zip` | Runs in a modern browser; host it on any static server | + ## The Crafting Apps DeckCraft is one of the **Crafting Apps**: free, open-source creative tools from the diff --git a/packaging/linux/flatpak-bundle.sh b/packaging/linux/flatpak-bundle.sh new file mode 100755 index 0000000..3097755 --- /dev/null +++ b/packaging/linux/flatpak-bundle.sh @@ -0,0 +1,72 @@ +#!/usr/bin/env bash +# Repackage a DeckCraft Linux tarball as a single-file Flatpak bundle: +# +# $DIST/deckcraft--linux-.flatpak +# +# Usage: packaging/linux/flatpak-bundle.sh [--no-test] [TARBALL] +# +# TARBALL defaults to $DIST/deckcraft--linux-.tar.gz from package.sh. The bundle +# is built for the host architecture (x86_64 or aarch64), which must match the tarball's. +# Needs flatpak, flatpak-builder and the SVG pixbuf loader (librsvg2-common) for the host's +# `appstreamcli compose`; the freedesktop runtime and SDK named in the manifest are +# installed per-user from Flathub. Unless --no-test, the bundle is then installed per-user and +# `deckcraft-cli --version` is run inside the sandbox as a smoke test. +# Manifest: packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml. +set -euo pipefail +# shellcheck source=../common.sh +. "$(dirname "${BASH_SOURCE[0]}")/../common.sh" +HERE="$ROOT/packaging/linux" +APP_ID=ai.storyteller.deckcraft +FLATHUB=https://dl.flathub.org/repo/flathub.flatpakrepo + +TEST=1 +TARBALL="" +while [ $# -gt 0 ]; do + case "$1" in + --no-test) TEST=0; shift ;; + -h | --help) sed -n '2,14p' "$0"; exit 0 ;; + -*) echo "unknown argument: $1" >&2; exit 2 ;; + *) TARBALL="$1"; shift ;; + esac +done + +ARCH="$(uname -m)" +case "$ARCH" in + x86_64) ;; + aarch64 | arm64) ARCH=aarch64 ;; + *) echo "unsupported architecture $ARCH" >&2; exit 2 ;; +esac +BASENAME="deckcraft-$VERSION-linux-$ARCH" +TARBALL="${TARBALL:-$DIST/$BASENAME.tar.gz}" +[ -f "$TARBALL" ] || { echo "error: $TARBALL not found (run packaging/linux/package.sh --formats tar first)" >&2; exit 1; } +for tool in flatpak flatpak-builder; do + command -v "$tool" >/dev/null || { echo "error: $tool not found (apt install flatpak flatpak-builder librsvg2-common)" >&2; exit 1; } +done + +echo "==> DeckCraft $VERSION Flatpak bundle for $ARCH from $(basename "$TARBALL")" + +WORK="$CARGO_TARGET_DIR/flatpak-bundle" +rm -rf "$WORK" +mkdir -p "$WORK/stage" +tar -xzf "$TARBALL" -C "$WORK/stage" --strip-components=1 +[ -x "$WORK/stage/bin/deckcraft" ] || { echo "error: $TARBALL has no bin/deckcraft" >&2; exit 1; } +cp "$HERE/flatpak/$APP_ID.bundle.yml" "$WORK/$APP_ID.yml" + +flatpak remote-add --user --if-not-exists flathub "$FLATHUB" +# --disable-rofiles-fuse: no FUSE in containers and CI runners. +flatpak-builder --user --install-deps-from=flathub --disable-rofiles-fuse --force-clean \ + --default-branch=stable --repo="$WORK/repo" --state-dir="$WORK/state" "$WORK/build" "$WORK/$APP_ID.yml" + +OUT="$DIST/$BASENAME.flatpak" +# --runtime-repo lets `flatpak install` fetch the freedesktop runtime from Flathub if missing. +flatpak build-bundle --runtime-repo="$FLATHUB" "$WORK/repo" "$OUT" "$APP_ID" stable +echo "wrote $OUT" + +if [ "$TEST" = 1 ]; then + flatpak install --user -y --noninteractive --reinstall "$OUT" + flatpak info --user "$APP_ID" + flatpak run --command=deckcraft-cli "$APP_ID" --version + flatpak run --command=sh "$APP_ID" -c 'ls /app/share/applications /app/share/metainfo /app/share/mime/packages /app/share/icons/hicolor/256x256/apps' +fi +echo "==> done" +ls -lh "$OUT" diff --git a/packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml new file mode 100644 index 0000000..6245147 --- /dev/null +++ b/packaging/linux/flatpak/ai.storyteller.deckcraft.bundle.yml @@ -0,0 +1,51 @@ +# Flatpak manifest for the single-file bundle attached to every GitHub release +# (deckcraft--linux-.flatpak). Build it with packaging/linux/flatpak-bundle.sh. +# +# It repackages the release's own Linux tarball (deckcraft--linux-.tar.gz, built +# on Ubuntu 22.04 by package.sh with the craft-fonts embedded) instead of compiling Rust inside +# flatpak-builder: no network and no vendored crate sources during the build, a few seconds +# instead of 20+ minutes, and byte-for-byte the same binaries as the AppImage/deb/rpm. The script +# unpacks the tarball into `stage/` next to a copy of this file. The binaries need glibc >= 2.35 +# and load X11, Wayland, xkbcommon, Vulkan and ALSA at runtime; the freedesktop runtime has all +# of them, and the GPU driver comes from its org.freedesktop.Platform.GL extension. +# +# ai.storyteller.deckcraft.yml (same directory) is the from-source manifest for Flathub. Keep +# runtime-version and finish-args identical in both (packaging-lint checks this). +id: ai.storyteller.deckcraft +runtime: org.freedesktop.Platform +runtime-version: '25.08' +sdk: org.freedesktop.Sdk +command: deckcraft +finish-args: + # Display: Wayland first; X11 only when no Wayland compositor is running. + - --socket=wayland + - --socket=fallback-x11 + # X11 shared memory (MIT-SHM). Without it the X11 fallback is slow or fails. + - --share=ipc + # GPU access for the wgpu renderer (Vulkan, or GL as a fallback). + - --device=dri + # Sound for audio and video in slide shows (cpal over ALSA, routed to PulseAudio/PipeWire by + # the runtime's ALSA plugin). + - --socket=pulseaudio + # Open/Save dialogs go through the file-chooser portal (rfd) and drag-and-drop through the + # document portal, so picked files work anywhere without broad filesystem access. Documents is + # granted so decks passed by path (the command line, Open Recent) work in the usual place. + - --filesystem=xdg-documents + # Deliberately not granted: network (the optional --control server listens on 127.0.0.1 in + # the sandbox; `flatpak override --user --share=network ai.storyteller.deckcraft` exposes it to + # host agents) and home/host filesystem access. +modules: + - name: deckcraft + buildsystem: simple + build-commands: + - install -Dm755 bin/deckcraft /app/bin/deckcraft + - install -Dm755 bin/deckcraft-cli /app/bin/deckcraft-cli + - install -Dm644 share/applications/ai.storyteller.deckcraft.desktop /app/share/applications/ai.storyteller.deckcraft.desktop + # .deckcraft; the runtime's shared-mime-info already knows the PowerPoint types. + - install -Dm644 share/mime/packages/ai.storyteller.deckcraft.xml /app/share/mime/packages/ai.storyteller.deckcraft.xml + # Already has the release's version and date substituted by package.sh. + - install -Dm644 share/metainfo/ai.storyteller.deckcraft.metainfo.xml /app/share/metainfo/ai.storyteller.deckcraft.metainfo.xml + - mkdir -p /app/share/icons /app/share/doc && cp -R share/icons/hicolor /app/share/icons/ && cp -R share/doc/deckcraft /app/share/doc/ + sources: + - type: dir + path: stage diff --git a/packaging/linux/flatpak/ai.storyteller.deckcraft.yml b/packaging/linux/flatpak/ai.storyteller.deckcraft.yml index 5c31015..85abe9a 100644 --- a/packaging/linux/flatpak/ai.storyteller.deckcraft.yml +++ b/packaging/linux/flatpak/ai.storyteller.deckcraft.yml @@ -8,6 +8,8 @@ # flatpak run ai.storyteller.deckcraft # # For Flathub, replace the `dir` source with a `git` source pinned to a release tag and commit. +# The release's .flatpak bundles are built from ai.storyteller.deckcraft.bundle.yml instead (it +# repackages the Linux tarball); keep runtime-version and finish-args identical in both. id: ai.storyteller.deckcraft runtime: org.freedesktop.Platform runtime-version: '25.08' @@ -16,14 +18,23 @@ sdk-extensions: - org.freedesktop.Sdk.Extension.rust-stable command: deckcraft finish-args: - - --share=ipc + # Display: Wayland first; X11 only when no Wayland compositor is running. - --socket=wayland - --socket=fallback-x11 + # X11 shared memory (MIT-SHM). Without it the X11 fallback is slow or fails. + - --share=ipc + # GPU access for the wgpu renderer (Vulkan, or GL as a fallback). - --device=dri - # Open/Save dialogs use the file-chooser portal (rfd), and drag-and-drop uses the document - # portal, so broad filesystem access isn't needed. Documents is granted for opening decks by - # path from the command line. + # Sound for audio and video in slide shows (cpal over ALSA, routed to PulseAudio/PipeWire by + # the runtime's ALSA plugin). + - --socket=pulseaudio + # Open/Save dialogs go through the file-chooser portal (rfd) and drag-and-drop through the + # document portal, so picked files work anywhere without broad filesystem access. Documents is + # granted so decks passed by path (the command line, Open Recent) work in the usual place. - --filesystem=xdg-documents + # Deliberately not granted: network (the optional --control server listens on 127.0.0.1 in + # the sandbox; `flatpak override --user --share=network ai.storyteller.deckcraft` exposes it to + # host agents) and home/host filesystem access. build-options: append-path: /usr/lib/sdk/rust-stable/bin modules: diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh index 721e0d7..0c54483 100755 --- a/packaging/linux/package.sh +++ b/packaging/linux/package.sh @@ -2,6 +2,7 @@ # Build and package DeckCraft for Linux ( is x86_64 or aarch64): # # $DIST/deckcraft--linux-.AppImage any distro with glibc >= the build host's +# $DIST/deckcraft--linux-.AppImage.zsync delta updates (needs zsyncmake) # $DIST/deckcraft--linux-.deb Debian, Ubuntu, Mint, Pop!_OS, ... # $DIST/deckcraft--linux-.rpm Fedora, openSUSE, RHEL, ... # $DIST/deckcraft--linux-.tar.gz plain FHS-style tree (bin/, share/) @@ -10,7 +11,8 @@ # # Needs: cargo; nfpm for deb/rpm (https://nfpm.goreleaser.com); appimagetool for the AppImage # (downloaded into $CARGO_TARGET_DIR if missing). Build on an old distro (CI: Ubuntu 22.04, -# glibc 2.35) so the binaries run on newer ones. Optional: desktop-file-validate, appstreamcli. +# glibc 2.35) so the binaries run on newer ones. Optional: desktop-file-validate, appstreamcli, +# zsyncmake (the zsync package) for the AppImage's .zsync. set -euo pipefail # shellcheck source=../common.sh . "$(dirname "${BASH_SOURCE[0]}")/../common.sh" @@ -23,7 +25,7 @@ while [ $# -gt 0 ]; do case "$1" in --skip-build) SKIP_BUILD=1; shift ;; --formats) FORMATS="$2"; shift 2 ;; - -h | --help) sed -n '2,15p' "$0"; exit 0 ;; + -h | --help) sed -n '2,17p' "$0"; exit 0 ;; *) echo "unknown argument: $1" >&2; exit 2 ;; esac done @@ -108,11 +110,29 @@ if has appimage; then chmod +x "$TOOL" fi fi - OUT="$DIST/$BASENAME.AppImage" + # Absolute, because appimagetool runs in $DIST below (CARGO_TARGET_DIR or APPIMAGETOOL may be + # relative). + OUT="$(cd "$DIST" && pwd)/$BASENAME.AppImage" + APPDIR="$(cd "$APPDIR" && pwd)" + TOOL="$(cd "$(dirname "$TOOL")" && pwd)/$(basename "$TOOL")" + # A .zsync left by an earlier run would hide a missing zsyncmake and describe another file. + rm -f "$OUT.zsync" + # Update information: AppImageUpdate, AppImageLauncher and the like read it from the file and + # fetch only the blocks that changed in a newer release, through the .zsync published next to + # each AppImage on GitHub Releases. `latest` is the newest published release that is not a + # pre-release. A fork's builds point at its own releases through GITHUB_REPOSITORY. + REPO="${GITHUB_REPOSITORY:-storytold/deckcraft}" + UPDATE_INFO="gh-releases-zsync|${REPO%%/*}|${REPO#*/}|latest|deckcraft-*-linux-$ARCH.AppImage.zsync" # Extract-and-run: works without FUSE (containers, CI). The output embeds the static runtime, - # so users don't need libfuse2 either. - ARCH="$ARCH" APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" --no-appstream "$APPDIR" "$OUT" + # so users don't need libfuse2 either. With zsyncmake on the host (CI installs the zsync + # package) appimagetool also writes the .zsync, into its working directory, hence the cd. + (cd "$DIST" && ARCH="$ARCH" APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" --no-appstream -u "$UPDATE_INFO" "$APPDIR" "$OUT") echo "wrote $OUT" + if [ -s "$OUT.zsync" ]; then + echo "wrote $OUT.zsync" + else + warn "zsyncmake not found, so $OUT.zsync was not written; AppImage delta updates need it" + fi fi "$STAGE/usr/bin/deckcraft-cli" --version