Add production .deb packaging, apt setup, desktop integration, and icons #28

2026-07-04T04:27:12Z

Tyler commented

2026-07-04 04:27:12 +00:00

Phase 3, PR 8 (apt/X11 half). Mirrors GitHub PR Twest2/StepForge#12.

packaging/linux/debian/package.sh: runtime-only staging (app + fixed Electron + prod npm deps via npm ls --omit=dev); never copies the dev tree; guards dev-dep leaks; fails without node_modules; detects arch; desktop entry + hicolor icons + MIME + launcher + license + postinst(setuid chrome-sandbox)/postrm; emits .deb + tarball (now includes /usr/bin/stepforge) + sha256.
packaging/linux/common/launcher.sh: sandboxed by default; --no-sandbox only via STEPFORGE_ALLOW_NO_SANDBOX; no runtime installs.
scripts/linux/apt/install-{runtime,build}-deps.sh: separate build vs runtime.
Original icon (SVG + scripts/make-icons.js generating PNGs via repo's own rasterizer).
Removed the old scripts/package-linux.sh; build-release.sh uses the new builder.

Verified: 276 unit tests; integration test builds+validates a real .deb; build-release E2E passes. dnf/.rpm is the next PR.

Phase 3, PR 8 (apt/X11 half). Mirrors GitHub PR Twest2/StepForge#12. - packaging/linux/debian/package.sh: runtime-only staging (app + fixed Electron + prod npm deps via npm ls --omit=dev); never copies the dev tree; guards dev-dep leaks; fails without node_modules; detects arch; desktop entry + hicolor icons + MIME + launcher + license + postinst(setuid chrome-sandbox)/postrm; emits .deb + tarball (now includes /usr/bin/stepforge) + sha256. - packaging/linux/common/launcher.sh: sandboxed by default; --no-sandbox only via STEPFORGE_ALLOW_NO_SANDBOX; no runtime installs. - scripts/linux/apt/install-{runtime,build}-deps.sh: separate build vs runtime. - Original icon (SVG + scripts/make-icons.js generating PNGs via repo's own rasterizer). - Removed the old scripts/package-linux.sh; build-release.sh uses the new builder. Verified: 276 unit tests; integration test builds+validates a real .deb; build-release E2E passes. dnf/.rpm is the next PR.

Tyler added 1 commit 2026-07-04 04:27:12 +00:00

Add production .deb packaging, apt setup, desktop integration, and icons

Template tests / tests (pull_request) Failing after 31s

Details

fedf1d24c0

Phase 3 of the improvement plan (PR 8 of the sequence): the apt/X11 packaging
half of Linux support, in separate Linux-specific files. Replaces the old
scripts/package-linux.sh, which the audit flagged as "not production
packaging" (it copied the whole dev node_modules — including vulnerable build
deps — plus docs/prompts/examples/audit files, hardcoded amd64, declared only
xinput, lacked desktop/icon/MIME integration, and could build without
node_modules).

Production builder (packaging/linux/debian/package.sh):
- Stages ONLY runtime files: app code, a fixed Electron runtime, and the
  production npm deps (enumerated via npm ls --omit=dev). Never copies the
  development node_modules; guards against electron-builder/app-builder-lib
  leaking in. Fails if node_modules is absent instead of shipping an unusable
  artifact.
- Detects architecture (dpkg --print-architecture, x64/arm64) rather than
  hardcoding amd64. Generates DEBIAN/control from control.in with proper
  runtime Depends, real maintainer, and homepage.
- Installs a desktop entry, hicolor icons (16–512), .sfgz/.sfglt MIME
  registration, the launcher, and the license. postinst makes chrome-sandbox
  setuid and refreshes desktop/MIME/icon caches; postrm cleans them.
- Emits a .deb, a portable tarball that now INCLUDES /usr/bin/stepforge (the
  old tarball omitted it), and a sha256 sums file.

Launcher (packaging/linux/common/launcher.sh):
- Runs sandboxed; prefers the user-namespace sandbox, accepts a root-owned
  setuid helper, and otherwise refuses to launch with an actionable message.
  --no-sandbox requires an explicit STEPFORGE_ALLOW_NO_SANDBOX opt-in. Never
  installs anything at runtime.

Setup (separate build vs runtime, apt only):
- scripts/linux/apt/install-runtime-deps.sh (Chromium/Electron libs, X11
  tools, portal/PipeWire) and install-build-deps.sh (dpkg-dev, fakeroot,
  xvfb). Runtime script installs no build tools.

Assets: original StepForge icon — packaging/assets/stepforge.svg plus a
generator (scripts/make-icons.js) that renders the PNG set with the repo's own
rasterizer/PNG writer (no third-party art). npm run icons regenerates them.

Wiring: package.json gains package:linux:deb / package:linux:rpm / icons;
build-release.sh uses the production builder and requires node_modules; README
points at the apt/dnf guides.

Tests: tests/unit/packaging-linux.test.js (structural: files present in their
separate locations, old script gone, valid desktop entry, templated arch +
runtime Depends, launcher gates --no-sandbox, builder requires node_modules
and guards dev-dep leaks, apt build/runtime dep separation, original icon set
generates a valid PNG) runs in the normal suite;
tests/integration/linux/package-deb.test.sh builds a real .deb and asserts the
right files present and the dev tree / build tooling / app docs absent
(honest skip only when dpkg-deb/node_modules are genuinely missing).

Verified locally: 276 unit tests pass; the integration test builds and
validates stepforge_0.3.2_amd64.deb; build-release E2E passes with the new
production package.

Co-Authored-By: Claude Fable 5 <[email protected]>

Tyler commented

2026-07-04 04:33:10 +00:00

Merged into main as 92146c7 (same-SHA merge to both forges; GitHub mirror PR Twest2/StepForge#12 MERGED, CI green ubuntu+windows). Closing.

Merged into main as 92146c7 (same-SHA merge to both forges; GitHub mirror PR Twest2/StepForge#12 MERGED, CI green ubuntu+windows). Closing.

Tyler closed this pull request

2026-07-04 04:33:10 +00:00

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Tyler/StepForge#28