Skip to content

Complete desktop release gates, native verification and AUR recipes - #22

Draft
LIghtJUNction wants to merge 5 commits into
mainfrom
feat/desktop-release-completion
Draft

LIghtJUNction wants to merge 5 commits into
mainfrom
feat/desktop-release-completion

Conversation

@LIghtJUNction

Copy link
Copy Markdown
Contributor

Purpose

Finish the existing desktop distribution pipeline without replacing it or treating temporary Actions files as public releases. The branch is based on main 16ceda1 and preserves the site open-source/GitHub/star/CSP work.

Changes

  • Reuse the six-target desktop matrix and both Flatpak targets. Enable scoped PR engineering builds, add Windows/macOS native launcher smoke checks, and retain Linux WebKit/Flatpak checks.
  • Add explicit native signing prerequisites and verification of the final package bytes. Formal desktop tags require Windows Authenticode with timestamp and macOS Developer ID signing plus notarization; missing credentials fail rather than silently downgrading.
  • Bind per-target verification reports to artifact SHA-256 values. Assemble engineering artifacts separately; only a verified formal release may update generated downloads/AUR.
  • Generate a small website download catalog from the actual published release catalog. Current formal artifacts remain CLI 0.1.3 and Server 0.1.0.
  • Add the desktop source AUR recipe and generate a desktop binary recipe only from a real released desktop manifest with exact architecture URLs and checksums.
  • Validate AUR metadata with makepkg and real bsdtar extraction. Preserve LICENSE and keep desktop/CLI/server package ownership separate.
  • Document manual download/install updates. No unsupported automatic updater feed or signing key is advertised.

Checks already passed

  • Release scripts: 26 tests.
  • Desktop signing policy: 7 tests.
  • AUR: 7 tests using real makepkg metadata generation and bsdtar extraction.
  • Python, shell, generated documentation/catalog and workflow syntax checks.

The prior existing six-platform + Flatpak workflow succeeded in run 39735931535; those were engineering artifacts. This PR must obtain its own new build evidence before claiming the updated pipeline passes.

Distribution boundaries

No tag, AUR upload, production deployment, Windows publisher certificate, Apple signing identity or notarization credential has been created or guessed. No formal desktop release currently exists. This draft PR triggers build verification; signing/account prerequisites are recorded in docs/desktop-release-status.md and docs/desktop.md.

The unified website UI is a separate small PR so it can be reviewed independently.

Re-enable scoped engineering builds for the existing platform matrix, add
native smoke checks and signature evidence, preserve manual update semantics,
and keep unreleased artifacts out of generated download catalogs.
Keep source and binary distribution separate, generate binary recipes only
from published verified assets, and validate metadata and package boundaries
with makepkg and bsdtar.
Handle the embedded license in noninteractive read-only DMG verification,
retain native verification errors, and make the AUR source build self-contained
with the matching Tauri custom-protocol feature and accurate Rust minimum.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant