#1275 - feat(packaging): Linux install route Phase 1 — AppImage / .deb / .rpm / AUR (#1227) - LibreKAT/Ocideck - Pawprint: You digital pawprint in a cat-savy internet

brenno commented

2026-08-05 16:44:05 +00:00

Owner

Implements Phase 1 of the Linux install route (#1227, design in
docs/design/LINUX_PACKAGING.md): alongside the tarball, every release now ships
an AppImage, a .deb and an .rpm, plus an AUR ocideck-bin
PKGBUILD. Each wraps the same flutter build linux bundle — no store, no sandbox;
the direct forge download stays canonical (assurance/app-store-distributie-positie.md).

What lands

scripts/package_linux.sh stages the bundle into an FHS tree and builds:
- AppImage — sha256-pinned appimagetool, run without FUSE
- .deb — dpkg-deb, libgtk-3-0t64 | libgtk-3-0 alternatives for Ubuntu's t64 renames
- .rpm — rpmbuild deriving soname Requires, so it resolves on Fedora and openSUSE alike
- Driven by make package-linux VERSION=x.
AUR ocideck-bin (packaging/aur/PKGBUILD + scripts/update_aur_pkgbuild.sh),
pointing at our own release tarball, verified against SHA256SUMS. Publishing is
a maintainer step (like the Homebrew tap), so it is not wired into the chain.
Release chain (.forgejo/workflows/release.yml): the linux job installs
rpm, runs the packager with a sha256-pinned appimagetool, and uploads all four
Linux assets in one artifact → folded into SHA256SUMS. Release notes gain the
downloads and per-format install steps.
Tests + docs: test/linux_packaging_test.dart (offline wiring), docs/BUILD.md,
the design doc (Phase 1 marked built), packaging/README.md, README.md, CHANGELOG.md.

Deliberate calls

Hand-rolled, not fastforge — standard tools match the repo's pin/provenance
line and add no Dart toolchain.
appimagetool pinned by sha256, not *_VERSION — it ships only a rolling
continuous tag, so the content hash is the pin; a drift fails the build loudly
(that is why it is not in .github/pinned-ci-versions.json).

Deferred (design doc)

Phase 2: own signed apt/rpm repo.
Phase 3: Flatpak + Snap — need the capability feature-flag first, plus external
accounts (Flathub review, Canonical) and the doc's open decisions.

Validation

make check green locally. The packages only build on a Linux tag, so flutter test
cannot exercise them — test/linux_packaging_test.dart pins the wiring offline, and
the real packages should be validated with a -rc1 prerelease tag before the next
real release (as #1170 was).

🤖 Generated with Claude Code

Implements **Phase 1** of the Linux install route (#1227, design in `docs/design/LINUX_PACKAGING.md`): alongside the tarball, every release now ships an **AppImage**, a **`.deb`** and an **`.rpm`**, plus an AUR `ocideck-bin` PKGBUILD. Each wraps the same `flutter build linux` bundle — no store, no sandbox; the direct forge download stays canonical (`assurance/app-store-distributie-positie.md`). ## What lands - **`scripts/package_linux.sh`** stages the bundle into an FHS tree and builds: - **AppImage** — sha256-pinned `appimagetool`, run without FUSE - **`.deb`** — `dpkg-deb`, `libgtk-3-0t64 | libgtk-3-0` alternatives for Ubuntu's t64 renames - **`.rpm`** — `rpmbuild` deriving soname `Requires`, so it resolves on Fedora and openSUSE alike - Driven by `make package-linux VERSION=x`. - **AUR `ocideck-bin`** (`packaging/aur/PKGBUILD` + `scripts/update_aur_pkgbuild.sh`), pointing at our own release tarball, verified against `SHA256SUMS`. Publishing is a maintainer step (like the Homebrew tap), so it is not wired into the chain. - **Release chain** (`.forgejo/workflows/release.yml`): the `linux` job installs `rpm`, runs the packager with a sha256-pinned appimagetool, and uploads all four Linux assets in one artifact → folded into `SHA256SUMS`. Release notes gain the downloads and per-format install steps. - **Tests + docs**: `test/linux_packaging_test.dart` (offline wiring), `docs/BUILD.md`, the design doc (Phase 1 marked built), `packaging/README.md`, `README.md`, `CHANGELOG.md`. ## Deliberate calls - **Hand-rolled, not `fastforge`** — standard tools match the repo's pin/provenance line and add no Dart toolchain. - **`appimagetool` pinned by sha256, not `*_VERSION`** — it ships only a rolling `continuous` tag, so the content hash *is* the pin; a drift fails the build loudly (that is why it is not in `.github/pinned-ci-versions.json`). ## Deferred (design doc) - **Phase 2**: own signed apt/rpm repo. - **Phase 3**: Flatpak + Snap — need the capability feature-flag first, plus external accounts (Flathub review, Canonical) and the doc's open decisions. ## Validation `make check` green locally. The packages only build on a Linux tag, so `flutter test` cannot exercise them — `test/linux_packaging_test.dart` pins the wiring offline, and the real packages should be validated with a `-rc1` prerelease tag before the next real release (as #1170 was). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

brenno added 4 commits

2026-08-05 16:44:05 +00:00

feat(packaging): Linux packager — AppImage/.deb/.rpm from the bundle (#1227 ) 1d64e77679

Phase 1 of the Linux install route. scripts/package_linux.sh stages the built
Flutter bundle into an FHS tree and produces three portable formats next to the
tarball: an AppImage (sha256-pinned appimagetool, run without FUSE), a .deb
(dpkg-deb, with libgtk-3-0t64|libgtk-3-0 alternatives to bridge the Ubuntu t64
renames) and an .rpm (rpmbuild deriving soname Requires so it resolves on Fedora
and openSUSE alike). A shared .desktop entry and the bundle's own icon key off
the com.dewinter.ocideck application id. 'make package-linux VERSION=x' drives it.

Hand-rolled with standard tools rather than fastforge, to match the repo's
pin/provenance line and add no Dart toolchain. None of the formats is a store or
a sandbox; the direct forge download stays canonical.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Brenno de Winter <brennodewinter@users.noreply.github.com>

feat(packaging): AUR ocideck-bin PKGBUILD + updater (#1227 ) 1561372098

A -bin package that installs our own release tarball on Arch/Manjaro, verified
against the published SHA256SUMS. update_aur_pkgbuild.sh fills pkgver + sha256
per release (mirroring the Homebrew updater). Publishing to the AUR stays a
maintainer step (account + SSH key), so it is not wired into the release chain.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Brenno de Winter <brennodewinter@users.noreply.github.com>

ci(release): build and publish the Linux packages on a tag (#1227 ) 5a7a638e47

The linux job installs rpm (rpmbuild), stages the tarball into dist/, runs
'make package-linux' with a sha256-pinned appimagetool, and uploads all four
Linux assets in one artifact — so publiceren folds them into SHA256SUMS. The
release notes gain the AppImage/.deb/.rpm downloads and per-format open/install
instructions. appimagetool is pinned by sha256 (not *_VERSION) because it ships
only a rolling continuous tag; a drift fails the build loudly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Brenno de Winter <brennodewinter@users.noreply.github.com>

test+docs(packaging): pin the Linux packaging wiring; document it (#1227 )

scans / scans (pull_request) Successful in 2m34s

Details

static-gate / static-gate (pull_request) Successful in 5m42s

Details

2e5cbf9b63

test/linux_packaging_test.dart pins offline what a Linux tag can't test locally:
the job calls the packager and uploads every artifact it makes, the script names
those exact artifacts and declares the right runtime libraries, appimagetool is
checksum-verified, and the .desktop/AppRun/PKGBUILD are well formed. Docs:
BUILD.md gains a Linux packaging + AUR section, the design doc marks Phase 1
built, packaging/README.md documents the layout and the appimagetool re-pin,
README + CHANGELOG updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Brenno de Winter <brennodewinter@users.noreply.github.com>

brenno force-pushed feat/1227-linux-packaging from 2e5cbf9b63

scans / scans (pull_request) Successful in 2m34s

Details

static-gate / static-gate (pull_request) Successful in 5m42s

Details

to 8230a5e4e5

scans / scans (pull_request) Successful in 2m40s

Details

static-gate / static-gate (pull_request) Successful in 5m20s

Details

2026-08-05 16:53:10 +00:00

Compare