From 73c207a98b31d97a1e20ac8c151ac5cbdcebf023 Mon Sep 17 00:00:00 2001 From: Johnny Huynh <27847622+johnnyhuy@users.noreply.github.com> Date: Sat, 3 Oct 2026 08:54:16 +1000 Subject: [PATCH] feat: sign release builds when certificate secrets are set Developer ID and Authenticode secrets now reach electron-builder, with notarization when the Apple API key is present. A Flatpak manifest is included for a human Flathub submission, and the cask macOS floor matches the Electron binary. Co-authored-by: Cursor --- .github/workflows/release.yml | 36 +++++++++++++- Casks/pidex.rb | 2 +- docs/adr/0010-distribution-channels.md | 9 ++-- docs/distribution.md | 36 +++++++++++--- electron-builder.yml | 1 - packaging/flatpak/dev.echohello.Pidex.desktop | 9 ++++ .../flatpak/dev.echohello.Pidex.metainfo.xml | 23 +++++++++ packaging/flatpak/dev.echohello.Pidex.png | Bin 0 -> 15997 bytes packaging/flatpak/dev.echohello.Pidex.yml | 47 ++++++++++++++++++ packaging/flatpak/flathub.json | 3 ++ packaging/flatpak/pidex.sh | 2 + scripts/release-manifests.ts | 4 +- 12 files changed, 156 insertions(+), 16 deletions(-) create mode 100644 packaging/flatpak/dev.echohello.Pidex.desktop create mode 100644 packaging/flatpak/dev.echohello.Pidex.metainfo.xml create mode 100644 packaging/flatpak/dev.echohello.Pidex.png create mode 100644 packaging/flatpak/dev.echohello.Pidex.yml create mode 100644 packaging/flatpak/flathub.json create mode 100755 packaging/flatpak/pidex.sh diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 20b8fd6..8d373bf 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -111,7 +111,41 @@ jobs: - name: package env: SEMVER: ${{ needs.tag.outputs.semver }} - run: bunx electron-builder ${{ matrix.args }} -c.extraMetadata.version="$SEMVER" --publish never + CSC_LINK: ${{ secrets.CSC_LINK }} + CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }} + WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }} + WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }} + APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} + APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} + APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} + APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} + run: | + set -euo pipefail + case "$RUNNER_OS" in + macOS) + unset WIN_CSC_LINK WIN_CSC_KEY_PASSWORD + ;; + Windows) + unset CSC_LINK CSC_KEY_PASSWORD APPLE_API_KEY APPLE_API_KEY_ID APPLE_API_ISSUER APPLE_TEAM_ID + ;; + *) + unset CSC_LINK CSC_KEY_PASSWORD WIN_CSC_LINK WIN_CSC_KEY_PASSWORD + unset APPLE_API_KEY APPLE_API_KEY_ID APPLE_API_ISSUER APPLE_TEAM_ID + ;; + esac + for name in CSC_LINK CSC_KEY_PASSWORD WIN_CSC_LINK WIN_CSC_KEY_PASSWORD APPLE_API_KEY APPLE_API_KEY_ID APPLE_API_ISSUER APPLE_TEAM_ID; do + if [ -z "${!name-}" ]; then + unset "$name" + fi + done + if [ "$RUNNER_OS" = "macOS" ] && [ -n "${CSC_LINK-}" ] && [ -n "${APPLE_API_KEY-}" ]; then + echo "signing and notarizing the macOS build" + elif [ "$RUNNER_OS" = "Windows" ] && [ -n "${WIN_CSC_LINK-}" ]; then + echo "signing the Windows build" + else + echo "no signing secrets for $RUNNER_OS; publishing unsigned artefacts" + fi + bunx electron-builder ${{ matrix.args }} -c.extraMetadata.version="$SEMVER" --publish never - name: upload installers env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/Casks/pidex.rb b/Casks/pidex.rb index 310d9a1..cc8baef 100644 --- a/Casks/pidex.rb +++ b/Casks/pidex.rb @@ -9,7 +9,7 @@ desc "Desktop workbench for the Pi coding agent" homepage "https://github.com/echohello-dev/pidex" - depends_on macos: :sonoma + depends_on macos: :monterey app "pidex.app" diff --git a/docs/adr/0010-distribution-channels.md b/docs/adr/0010-distribution-channels.md index e0711bd..82e8364 100644 --- a/docs/adr/0010-distribution-channels.md +++ b/docs/adr/0010-distribution-channels.md @@ -11,10 +11,11 @@ - electron-builder wants semver; CalVer tags with leading zeros (`2026.08.09-2`) are mapped to `2026.8.9-2` for the packager and `2026.8.9.2` for Winget. - Builds are unsigned. macOS Gatekeeper and Windows SmartScreen will warn until Developer ID / Authenticode certs are added via `CSC_*` secrets. - Docker is a Linux/X11 fallback, not the daily-driver install. The app reads `~/.pi/agent/sessions` and expects a local Pi CLI. - - Official Homebrew and Winget directory listings remain a follow-up (manual PR plus, for Winget, a `WINGET_TOKEN`). The org tap is the supported install path until then. - - Snap, Flathub, Chocolatey, and the Mac / Microsoft stores are out of scope until there is signing and a store account. + - Official Homebrew and Winget directory listings are manual pull requests against the published installers. The org tap stays the install path until those land. + - Signing and notarization run in the release workflow when Developer ID and Authenticode secrets are set. Without them the artefacts stay unsigned. + - A Flatpak manifest lives in `packaging/flatpak/`. Flathub submission is a human pull request. Snap, Chocolatey, and the Mac / Microsoft stores stay out of scope. - **Follow-ups**: - - Apple Developer ID + notarization; Authenticode for NSIS. + - Add `CSC_LINK`, `APPLE_API_*`, and `WIN_CSC_LINK` secrets. An Apple Development certificate cannot notarize. - `electron-updater` once macOS builds are signed (Squirrel.Mac refuses unsigned updates). - - PR the cask into `homebrew/homebrew-cask` and the singleton into `microsoft/winget-pkgs`. + - After the first `echoHello.Pidex` Winget manifest is merged, update PRs can use `WINGET_TOKEN`. diff --git a/docs/distribution.md b/docs/distribution.md index a6aabee..cc3e6be 100644 --- a/docs/distribution.md +++ b/docs/distribution.md @@ -2,7 +2,7 @@ pidex ships from GitHub Releases on every push to `main`. Tags stay CalVer (`YYYY.0M.0D`, see [ADR 0009](adr/0009-calver-releases.md)). The packager matrix and public channels are [ADR 0010](adr/0010-distribution-channels.md). -Builds are unsigned. First launch on macOS needs right-click → Open. Windows SmartScreen may ask you to keep the file. +Builds are unsigned until Developer ID and Authenticode secrets are set on the repository. Until then, first launch on macOS needs right-click → Open, and Windows SmartScreen may ask you to keep the file. ## GitHub Releases @@ -63,13 +63,35 @@ $ mise run package `mise run package` builds installers for the platform you are on. CI builds all three. -## Signing (not wired yet) +## Signing + +The release workflow signs when these repository secrets exist. Empty secrets stay unset, and that platform is published unsigned. + +| Secret | Value | +|---|---| +| `CSC_LINK` | Base64 of the Developer ID Application `.p12` | +| `CSC_KEY_PASSWORD` | Password for that `.p12` | +| `APPLE_API_KEY` | Base64 of the App Store Connect API `.p8` | +| `APPLE_API_KEY_ID` | Key ID | +| `APPLE_API_ISSUER` | Issuer ID | +| `APPLE_TEAM_ID` | 10-character Team ID | +| `WIN_CSC_LINK` | Base64 of the Authenticode `.pfx` | +| `WIN_CSC_KEY_PASSWORD` | Password for that `.pfx` | + +An Apple Development certificate cannot notarize a public DMG. It has to be a Developer ID Application certificate from the Apple Developer Program. With the four `APPLE_*` secrets set as well, electron-builder notarizes and staples the macOS build. Windows uses `WIN_CSC_*` only, so a Mac `.p12` is not sent to the Windows runner. + +```bash +$ base64 -i Certificates.p12 | pbcopy # store as CSC_LINK +$ base64 -i AuthKey_XXXX.p8 | pbcopy # store as APPLE_API_KEY +``` | Secret | Effect | |---|---| -| `CSC_LINK` + `CSC_KEY_PASSWORD` | electron-builder signs macOS / Windows when present | -| Apple notarization keys | Required before Gatekeeper stops warning | -| `WINGET_TOKEN` | Would let CI open the `winget-pkgs` PR | -| `TAP_TOKEN` | PAT with `repo` on `echohello-dev/homebrew-tap`; pidex dispatches `pidex-release` so the tap syncs immediately instead of waiting for the hourly cron | +| `WINGET_TOKEN` | Classic PAT (`public_repo`) so a later workflow can open `winget-pkgs` update PRs. The first listing is a manual PR. | +| `TAP_TOKEN` | PAT with `repo` on `echohello-dev/homebrew-tap`. pidex dispatches `pidex-release` so the tap syncs immediately instead of waiting for the hourly cron. | + +## Flathub + +`packaging/flatpak/` is a Flatpak manifest for `dev.echohello.Pidex`. It wraps the published AppImage and grants `filesystem=home` so `~/.pi` and home-directory workspaces are visible. -Leave them unset and the workflow publishes unsigned artefacts on purpose. +Flathub does not accept agent-opened submission pull requests. A person opens that PR against `flathub/flathub` branch `new-pr`. Reviewers also treat host-dependent developer tools as a special case, because pidex shells out to the Pi CLI on the host. The manifest is here so that submission can be made by hand. The AppImage and `.deb` remain the Linux install. diff --git a/electron-builder.yml b/electron-builder.yml index 0076603..1e97cd1 100644 --- a/electron-builder.yml +++ b/electron-builder.yml @@ -22,7 +22,6 @@ mac: arch: [arm64, x64] hardenedRuntime: true gatekeeperAssess: false - identity: null entitlements: build/entitlements.mac.plist entitlementsInherit: build/entitlements.mac.plist diff --git a/packaging/flatpak/dev.echohello.Pidex.desktop b/packaging/flatpak/dev.echohello.Pidex.desktop new file mode 100644 index 0000000..ab21f5b --- /dev/null +++ b/packaging/flatpak/dev.echohello.Pidex.desktop @@ -0,0 +1,9 @@ +[Desktop Entry] +Name=pidex +Comment=Desktop workbench for the Pi coding agent +Exec=pidex +Icon=dev.echohello.Pidex +Terminal=false +Type=Application +Categories=Development; +StartupWMClass=pidex diff --git a/packaging/flatpak/dev.echohello.Pidex.metainfo.xml b/packaging/flatpak/dev.echohello.Pidex.metainfo.xml new file mode 100644 index 0000000..3d52a12 --- /dev/null +++ b/packaging/flatpak/dev.echohello.Pidex.metainfo.xml @@ -0,0 +1,23 @@ + + + dev.echohello.Pidex + pidex + Desktop workbench for the Pi coding agent + CC0-1.0 + Apache-2.0 + + echoHello + + https://github.com/echohello-dev/pidex + +

+ pidex is a workspace-first desktop workbench for the Pi coding agent. + It reads existing sessions from the Pi CLI on this computer. +

+ + dev.echohello.Pidex.desktop + + + + + diff --git a/packaging/flatpak/dev.echohello.Pidex.png b/packaging/flatpak/dev.echohello.Pidex.png new file mode 100644 index 0000000000000000000000000000000000000000..c07ff9c55b18a57170da72e50abb9101781ba5ff GIT binary patch literal 15997 zcmdUW1yfu>*XA%l7~I_*f&_OD?h-7)9fG?vxH|-g;2{v)-CaU};O=h0g6++_Z+%s} zRr>>WC~BteOyApm`kd$3(~+vmGN?#INFWdhRZdn?9Rz{_KEi+?Z-6&F=WiCk8-=N? zx)KQFO$P!&LqMRvz$NGb2;{~F0v#EFKmzF?5WZt}tC|q-#Tyd^8A;IVzrU{?rOCh* zL`PX&7Z3=o@83Vnki$1K;39&noRSp65fT`W6X6igP87IA>nf$=YG&+eE@0|x4!nUl z*f@At*x6XvI6iQ22ypQUaB(uRu?euTA#=HY{XYiSIha{nc>TWzcw3K?00S8Q=LxRX zcIGaw#&(YX*BEYg0XE+M{Sc!qP6}WQ;lD8&4i>H+#?Iy-4-XGkYx~bGrpAuutPakW zS!Y5-AdoP%oTT^%&!y82Yezlp%#yq8ET#lm5F!QkBN_%1uPTjHVu57YhvJ6T@8$Bj zxizHN_VJ{`oU6GJkpzMkCMQlI&wcD@Q}uTj&8Ib_<{kL9^l!J9kAO$`P=T z7;QEBx5(EPl401|K;~|w^ld|=fn==MfY3m0BU~N0_HF_;Fbb%!+jg90Ua_X_?t5G} zjjI;Eu$cCD(J>FI+-DXZ{L*p=<4v230VLs9Ao~b9C_L~z0d^1Zc!c(1pS27gX`?Z2np>+rh-(+YNh#>k$tv-?>@YOvWg`~IxMp1UYi;3x zFOUZ8X+f^Ad0=vI6BHH12qz)`#E27=0uj@)SM&A5QSdDXnfAW2Y`{~9nrlnuF9_fT zDs&r~Kzd1_tXyzO4FijIj_CC^irb*e*@2HTVPUZ&gWgM>;xh}y{$_ugg00eT}D(LVPO$bt>E)rR2^>DtcQ zgv;_@b}h*Hz2C9A07>5dG-1*Ak0Tn*WZ!TNLgE z*Ad)cS*0oj;T)Wt&$3Eq`yMWVRc*lsL4eJAf#uZ)WwWAFV5r0Ph;JCezJi8VTaQar zPZ(y?F*!7m-N?1-_V;1}%}JK=`k+6=iUFkIj&7-aRI zEMiL>Bw0kLwoxFneLSkf$OO?(kQc@aLl~*D7I&n9TuSu&PPQuxQZd7-u~ zsdrv6Z43?b7i{6G$qPTcc=vCm<3qWrk29zOOYuOKl|%QzI7aF2FJQi$qw*rv6DJ#} zX}22&r$o@)%b&5pQY;Ylj7o250FLPux!g^v8pE#;^$oADq&+x7e##q>@Dzfj7y&Q~ zJkU0km-l6zR7g^pY9W}2dg5%@3^&QRqtqnc9GIR34XvD27(cO%1F$a~wu4m}aLP8{ zUU&qO!O0?iR#6psGJCvMr=tsCyjU-!>yk*ci8CG_P~S>mfqw zAZNV?SvVrBkbCMFBvH+sLe&#yI7b}<(x`I^IG*xkN2}BP*Mmf`(Zq0^=+S_9j0Cyn zTDj_pqAdZc`y^}~y{0>`WDJ1%HW{C@lf4E+ z)tqTpiiDc%YoIgBH&?(AW}pS34LMpxTIlE4bQx z*N$#!P#bSZcd=d|5fEz9lo&i6vTq85xeTlLew`4;s%HmnUGVZ)(!qE>c!>^DFn3a*EBn`%00hk=U@h)( zu;)mWk%xCx_g$2rNg?#i*+l6dujGZbFM!?4z`p3ntC_G%ov$vbyzJ_map>P;$4pWq zg__*CU~EG~{w(k^-6w++a`x#A)(k;Uq#u5CNz`a#5V*98amv-6M}m{U7*RB@_plp| z-(@NmJ{HZ^=-BC0@D!y?y@W;OOd7{vHzOW<vM_@pyx z@E7z13ZMZ4ae11J@e$M4nlwJ|zivol-xIL@$YKZ+iKjE;;H0V=tVRe^CpV-@N%Wv@ zAASundY6bePQe!);>czMfwIiN3~Ib~buWNFoWK-SnvM+@b?!ojrrMQmI<*unm=Z7E z(6S0TWZM=uG=>xxn}2zNskl{)8ZBomtAI6f^GdX$sVE5S2qnG84T^PSgF5cv(lx#s z!1%+O6?=z7S-zK#95E{?s{QhXx|D&nN<3XrQi9T%Ls6)!E3@&-N0JOeP=$l7W1&yF zLQ|OTVuW$cVuE*!^*KcU6hEDam*%IekK~3oS@$@G^XCreh6HR$4v)yf-scRh$)c!5xU39$a1!<+30HfGR8We zr)nHt)oPvf`U}+lSf#gO;g{xpE~>4^pzMcjdd3Ri71`Z>x*>Z*pVnGt!T&-LXvHUK z9G9bEcT+#BY0{86eKWLtKF=l2hgEFpm|Z3CH$xZAq;UxYg6F5T^YxUfD8(u>a_fpHuJehGMMgO(HAjI4i*lyI<;aNJp~Lk) zxAY~so!2T;x`sY}Z%O@xECBqV;V<4yEQl6*HqT&?omjPFlH zaOHCnZn~5=xMT(S6m{2Q{Y7D8`m$bj)M%EhpUV|&D~MMuQ!!4E;H2+1R6=KVN5C&c zp4@YV>Ov%pZX6_wvkfFAmm5yCF31rBCI{0PnxTu?BEMvnq}Ve{?7Y3IFu?lrgqM?! zogHb38Ms_^sL3NC0bYS?%i4q|HkN*Nnx}XtXd*IK)SIqeHc*wor4RA4m#cu8)+{ho z*%h^%(&Q!~iD4ijFgkwZ_xhImjGDS&_j|}-Uz8=24iZY`dK>Swxd(D7r)1VDEO4}6 zQt%j(8VvW22zd|eDNk@WddSSK7yLc0G&=hLTCdLj=jLc8D}Lvst4!%}Jf=;@2*tXc zmJ*~m@)a57M$<9+m!@g1o+#1oxlgcq$Ap%`V6F04E3WZ=M{+>lFO_2R%b&WH%?a-# zN4{*{!$=!Lla5IxsC=iKa2+@9$As>-&>ho0d_5N6AS!66g_7s;_vY^r+46jrU-4BB zTD2%HDTrvT1xpYg-{XBr?3K(dO~1-~!$G3_TPrPzr3?@?!+1AtGE3hj=f=Q?cxht_ zH&P!9yhk*W-TREDZxx@VIkO_ef>U-auYN~A^55ujwkQw9)m&Own*UPOkd_NfF5bn( z(}vZtCB#Y9QvawK|C8&9DO$3Rk`^q8fO^2O$Uzc-ZY6hP^(!Ytsj0m&aocjOWOIZ4 zBtuuSm(ux^s7gqC>bMk5O)niC;yySVA5Xe{cs4ne-_n?pjl$XaAO$8i=BRUK`0>58 zx+qDOZ+K}GtF_X0NH9bW*hAKWMv#W|uaZwXfYr#oJHnsfq^Jh*PrZP{qPs?riTo2RcJ9KIwoB9khKc1a)@%~k49-sNddR?h7Nv+ zr#Y2fa@9Xs4oLa?d*9J)A0t+h63@cWOQbZOOI_>4-|FE^SqcK9&cV((^>9n}w;lPb zF8inPibrjN1KZN`TW&xIqwd)P-het}z{#r%C%IA?&-_?w%G>LsAHK#ZJWjIWla(`| zd)Ihc$Zo%|cy{t)QHUr`LsaOnFs4oVtjPL??bC@>rje6wz6!OAJizEOYs;dze4`bS@)_4*C=>#|iQMKxJb;pd2| z^O%(e(jgN?pYZL*ZAz2xEQ{{7Z?jpa-bg2d2JjMfj$2oxxX4AsZ#tiKI5{Fi`g9~? zVBH3?g;pX2-ytBjv91K@g|MOJWEg(j{1q!=kEV#3NXM+j1OQIqbB?Qro{5wF$6bWR z@M_0aA+_0&u1{ep0)S25{E%5_dS#egX)jW0YUE3snc`O0)T(Eie^61_s*6*abbj%E z_g+H*Qiq$oI1X&>vq$B0z`g*?Yi%v514}D#w?n6SJ5K3kJHgbO39hD`qOa9l)-yL| z%Y1WMDxdvmwaU$>LLcL!OAvcE8T5lq^$rM(+-Z#k!{FC(R!P$ch!4~ow^<|+yXle{ z)>)X#3wDPYN59`1b9{n?zvp9itSC+@d^{d;wXyT_h{Qzl_+*6n&86Zr@zV92kKYb z^C}vK`i<0A7>LW4KkvB=8}8TzeCFNTTZL54e=woAtr`h`wH?X|#DZFi$&=O%NP8*4 zve?mIrf7kP0OfyTW}-)*bNZT()aG|=*BUPY3B&-eKVgvvIAx%Vv<=5Nz(6HD$Q-)< zf*m^kfR&FX%BD6kGPV(883#AIC~F&x|1kKfLoS+Va{FyqMo&4=%tnmBUo7ob7wx@g1ufFT_zBxA%3p zy6KtO+vqLEP&M}kurLO1>SnvX0b!VCRv4tbkK3c`5TlOyPg6ReK;9pPs+{6!W$ zwl&q57o4+h!E2wib#yad2aj>%r4hSLO%_~9XSv9VE`MG(BOy(@iXjWNKswY zic>cd(h2)}8f1#i`SiER@M=+eUiYJZ-=FkP*6jN9^BDu>rEwSAyaolW?F-Fs%J8@- zBL+=SVw9aaJMhn+i0GnGlS^vaHwyRn=27lesG2)V8d1ryX+iP8h9)mcSZfNi*p)K8 zt&+APN>q(lQN*T4n{{k%`7)03X|&IeQVbG1P>kz;x2x%YeW>kOy0^6+P+Mx!>!tJY zWDngyaNyW7F8O>^TwZuLPErZm);6Shnsa>j(|hJ0Lt8`H$K%Q|zvlb{0TU>gt{z1f z0@H%fDZECNjS(lp4Zk`YGHGSy$nwQ#Mmv4$Oux|0la0^S8`7~0!?9pA@jnOb*E}G_W>s08Flu&70^D#0c zCj@(Tv=W{OGd0R%+xmDb8cr>kX2pdx&30q%_0RizMOw<(W?5%a z;LRMKk?%goPdXp|CFKdqN2t8c!vi*U*)H4a^RA^sUVcM9QL@}Jj9UDqV0wD)wyzKR z^O_VJVdHl95fW_9{9%_1>g#AyEolIPJm^gPNI=Wyjpk#FhWnKet*ky4YB*v9Op zAJ_aTN>*jf4+Lxtm#4j%s{7S6ZC#y@;t;#BGbcvzG=YbfMc>zA)2E(0!=i%zI%*Wf zOu7ikfLv>jTPKm>W%wMy-B*OTx|$(gfcjwsUL z^jgn*b~a>E|7bAd=TH~9?19{+Y0uw3^}6{#k9bMbmjs@U`P0++NLgcw`aeq<_*^oy z@K2_^Lyq}ux)8T4i16@t5>hTsT0SAojA!cY8&P?StQe1u8C_OuBI^PJm?$W%Euy54 z{+m4?l*N9A8+%(!ACn%PcWY#76;p*DYQ;4;&)e$x+E=%7Mo2{zD|{{RYCY{1xmYp1 zq&n7ip1mpgiOIs{D7F|tpp`8o!}X)m4iB(?ol%Vrq8%K;;d#;HAnlhui(ew5MnF9J zBJ~|15vgc)WPCKggpbdNJUk*ak88||B;+|NyN&WlG=}Sag zcfkx@-R9^qhVrHGMVo=HT3NpO#73$FcTBO~l22;$k_yXmNKvCnJo+Auu^Qp1S(Ouw zoOZ1eV$3Boi@f7Lsw=B+>F=Hdq-%gCVWtYue78@2t+9CiH%A3nFD$O2N689ywnH+c^O<|6!$ z+yU2*(TWq}v|U|`^J?;PPR20jzUMR!omWC#AR$Urcs31dUf#_Y?CJTMq^Ma4x%ig3ljto(4 z)7|;6EVY{^Z8{gr?rz(Z#1Bd*p6>`g{<7{R0$JOiJGFk-oD*gQO9QKIdWTL) zJM%IpKMmo_P_eY6wI24h*8>v#$~6-|>idN;N=90|Xm}N4_FYX)v;CbQj0)z-X^&&1 z;8orQ$o<`)S|b%CsPRmLy4I@LSYooL{9DZ4>cc&L<}jtEn#>qdqnTAjEF}?p*PH7# z1WW6#83jHPucIeu<*^P6-qP*)_G*)1zTK+`GoHdx-?L{3C%51fLRVKey=9k$z41dC zH8~^gZ48S1*jon1Dhf_cZ2kDnEFxeJu+}yW3VdeW+e_gnYKpg&7hI1st5-~C>^?JW zKfFh6cCJlmT~QnQY)40@)JLwfzp_jGbhZ7Cki@T6!!w4y?Q7-t6j9%6+R1DyYC$F! znT24b%)!x*&^mm<`#E|;4lW)dmiJC(QMF{Fb3B zSRZLnQHt6A-n8Qefg6j=u&V`jtR$v)de{}%z_&87wgBuNq~sweD}-vfhj)Kbr{Mea zU~aLGPyRPWv0{JqfpyJy7w)|M7Cev}L|QkAE<;tnezyIL-u1PxE>D)G^{|axU7jmB z^63fu_WNhY-Ca|T3?0Ky=4|$Y2KojIoK)5HaAGrxvrUcDEAB}v%}Ts@Xlj|~8-Eht z5ZR2nhbZyl(%9@ihIar$zk_#n_NYRP?A$U`)*g8Qy*vLa zYh;;XCrq7bAz?)X1a>2nJF&?uv#Bl9#flF*^IU-`9$ES&NPv4vpJ?~|19~L3x!*Do z?0Q+%mSudHMmN}*(~xmA7mU?U!cp-Df`G=(o(HC;`vDotL-Jdq8-!(@laz(G%#QmS zYMM%4ILC$w2bO!RKOQOM@&*f2g4E@)Xsy=DbVZ)z_pKCgACKi7Ef&>r)7KP$F^tNnlPeSW3!CgyWU=}g&R7a zS~%2(E^6WP`DHPeCSQ%(L`5l7>)0K5$2hV@%vo?MyRT7?jR22+Gx)LTanH@0EA}$- z`A^($=k|uEzs|f`*S9+$ES}YoL$8;;JN*087N&6)=Ib8IG|!tI%$JMUnGf0o;p`4~ zO0G@T!>DVo7tE`$g`hvEvDY&=Jdd&=)70BDKoGV6aMJ7cWt(NZ@v+RIZkdslrLdws zNiiH28hhjB>muT+U;6!fREO(_MKUZY!d-u6wL!t8@ZO`$!PZ{oPLr+@26 z8#KZeUQg{kDJsoC!m0H-=SFC+LCOEoX;2jX?E1bK(V{M8~R0XTHGaqsAu987W&|k&2=aR zW~^STKRscrtu%5SJ>~S;>h5S^!S_sH@^p0>I$Wcpqevoo@i#X&cEl=gfjK8oU}~|l zj5}?Q!qW}Oq^B>atm}{tefn-y$=GY$Br;P=Q8VzHmuvE!h``tb6YnJg4;fJ_5hld- z7L}8aXC$)m%e_XEg+^X$iRVnh6sz9;e3$T)l@O8F&*l(NGTS&;zyoidOG{xid6$3Y zdB?pT2Y)jmO+n(aaB%zUrY>uf2VG&}Y3>u644!#vDo$F8al>MQ`j(;o!2WejYilN6 z$yZ?}5Ms=UPt0K?JKnxU1_`;bZ$aqqFrv67Ej5j#_(faqf>J#bCL4GAM0C-vewjQ& z6Zc7mTCbI#a|>Uh0ZE|&lDc}H8PvGb{bWnq_{h3?vippVz3dmi&PC(Y7w>I(PyRAx zc(psv>vea^Ng_D=q_`X$Y1Qwef?PLn9wFUG#26ba6D=>#SXI%VxC=)?fWpDcJM`-p zR-&v~Rui$tP%b_cZZMN|Sk(}}P6JyphL_{SZc9~zTPBN%VRFj9f-WzTWBFZI=g2!z zk)iHkN$0VH$RV77u3}u#fSaCuy|aUzp{l&S2K@M~sHO#PJ;LUBg6rt`DW{j*puAGA zTAR!oyG5tc_|AMM10i>4UZ>k$8B&O1=HRdIc~f0cGSt|dmw7cE*z0B-iRZVf0FG2L zy*tZ^sIG4w*7MCl_gRPWd}mD!7_^4fM3=;T>}P3zqk_=D8b6_V^?^-4^BpsDf@Pug zziF8zn32+e#~kt@_wBh^_K4+~^6py^9ya~*dbv)dvYOZ77q%V#sakZaEQ|T!hUKEi z693^odhC8LEti4Fiy*QSwoBL}^j7e>{bBUF{kkI=2VbOBa$%Syq{Xu?{7&SFik4*@ zi~EJYh4t(%kBg+ZHCYznmwvlCQ?i4sugV}y( zOU$E*n`GSZl^&HVX|qPo|7Il3*S{th_w~1}8lj5*NbIEl->^Y`w-b=4&oN4@Tk875 zEVngLx!lYY{~H;4V`L|ETy!HnUO9MVd_b=O>Phut&!mx!;TZJyZ zZZ~*=H?b)d*PI-jj4V|}MHM7%t8pnw4cwwGo%~u_TE9B^tv(`&fhpl?bW$Q~jQ9LF z731RBc&2+_!fbLKeiYO)#CJ<4#7`OQX_M!e+qnDBK4lO(a5lCZp??=U;Ob@q&Kno)C1XJuV0doBxj@RkvCwVWsKMJjgr%1p%UX$Q+3tV30lWb;fcS&31Sd& zN7J0Zv*mGR?+g+Llm2B%4Ld@Gau@+0dPD_mx;jGPM&UVUkGxitAES^omHNx@s=Pt{1OOG9?r-S#W357F zQ_ksrKX^UB1LbEfBBij$9wRm{KU{fG5{-StTq^BZeZWMD2ToN}YHt$9)hb!7i*rU! z#-JciP=K4;@{%0A|KQI9xYxe{0rBxuKt1K^ZSv)B!)0BzYdb*GzX#;RcQwb16ggFw z#pS&oX|!vID3(}G#R~C+ErKoG(ExPzjEbt!`EgLA<189rXUD?Qc$14m3tFeD!Di#- z9JuNgqQ%vm8=oN z1BO8OoH_>eW;-jR=zC+}(O+qfy6o9m-VIh}GhbJ@^%Ioodv9mK1w`yu`S5iP^*G3AR!pGaNs{{ zEj@qw2^wO5q-YY{Y)$-7Mv9gvASbo3b~2s{Pme62EZyRUiH*#J`nbcm>JOQ)yZpTu zzvZ1#VE=|3f!E4#=dBG0N&o9rF&49;T0EcM(}v&8YrG&@ z)`YT?HKRGMCXjU#ACFwET5)~veJ&M4?AD+Np}<1pTv_isnT4CXiT&{VtS>QDO8-6f zSufR~j7<971f9e9YJbNNls+eLAWUY{T2Z{!{v@5m>U&{l>r)LWR9#-tg44b!JnAU3 zNQoCKl4kw^C^H2j-R0rYf~KGtLEV{om09x{S8;0d3-WSaw3Y3?*^B(+j~0aFq{d!e z*7NnrzuidNRvT$M{_TQ&-NjMaKHsc*fFU}x|3=QXW^Zp-O-(a+dArA~ai!sKa-xO| zLeLfb!LV9C4yg9gIL)w5K3cv06-wSVpXENKU)PsalVb!PQ&LKoPC!hJp|e~=_4Qvp z#x%h6)NeJAr;a^h+E9%C9dDNC-|5fUe82w2vWjJ5mDbH`;Q*(qhF52PqMdQeEn9R&AhLlb@ucm z6dfJ?-PZ$I6roL zfv{HydDkV@-0lEqc?nx}KGv?I5P{gbvTCdRQ=i`PEf!K}(r(+K)yyg@P;-U9~DNBvUAP-{S6jfHA1kUc63g`Rm|_4kC$kH2=SZ4QhaH13J^~&wy^qg z&cwvWRqq)pebmoOkyLtdK_K$F%i$zhT#uNuVgHL#vQbH+YMXPI=` z{Ncg=NEMtwh4lcl{)a{Z*(F8mgT^E3vJ*`5no|i~yNa2hvf|m&s5+2HqNu%pk+#x3_7^wT$e)V% zfl&B{$#rp{F+d5S)IqP9c4-T?J_k^i1(;;=v2)_C>lWi%3tzMJ-Qs~q2@C!Ck@0Gm zE35WMD?i#2V3zRFOfXA69V-Xd9PGklPb=BAhi76bpc9IuQbLwVdKJ#^pO@m>s?&Q5 zOq}(-#ub$~*hS=xCi3bJ$*h)!+RlCJVm;-RCGmp9*cA7Fa?Q665#*$+@vM>pU_dHM zr64NIKH0m%Y@XUM%fpkLOf1?rd1`Fpi^GDqbE>U!v2l(5s6NG`%Xh% zC%62^gnWDd2t{dV{(*XC_DXWjtrV#{Pj4Gk>k;!X18_ zns7SoX@mJQ#E2GS=XW>Fsjz8`$|TWlTVTVf0v|&o5MTH}9hT$hhh#34>*-Vk?JJo3 z?YTwW{l&0@jA-Q77nrpLh6srA06$wc<9bIS54y#;TZ-GaEKMg^A6k&)d?fzNx27&9 zm57{tyYVDe@M2_Uk;s%|`UeGw1Qh-Qobd&4M(99Q!qhJ(urdoM<#TS@S$MW5_DyIC z&Fcg%oBx?pIS?!G_3&S;K3qGw=HNe#UUmf}XaMvz$aW2uFHb+GWf1XR!9JVbkbEvP z39v()R3rv{CI*~lVRGF#FteFAz)DD{MZa!mZEhIVs=NQJ|H80LsA5_NDre zwft(8O9D|W^TH0OdGCQ{u9-lJQ{!}P=iejq42o_mtOpvC`6jHE1m*d#Xh|Y#+v`)Z zpQ8Q%Lx9YcU2nvJ;TO={L6RaWgcHk`HBA9A;8@3CfkLTb)xcj>i`eBsI8j{Eh){{d zK?WFAhF=8#fBpD`A0}b=1G;$r0{00b494XvrbI&Gp%_p#dP}KlOC|wf#v5CG%{zjz z!`l0RZp0ZePyoCpO;kk)-D0fy_yY$ACm}B{zQlU)885oT zTPG{%A9n!1jI6)zUu1)bjZ~SOlNHZ7Bo$Z+QE_6VfZRVz7OI7)QaR$wec{Xk{5S|m zt03WhM?|Z^DOh!jivIp0=H}+jdaR0c*ki~d_5prz86(pl(491ZiW&%-!hBznPI5|* z7rPOI90=fiJD4|7HvNWMw6(H4iv)-djs6i(q}|~ zR)94a_Lq?G#ME!1tJFU+s#Hcka?XZUR5ULr2wcHK%ze#8|@kX7$GeI$vHJzScLfGZb1EGIut#H<^&TKaK8 zby3PnJ6Iy0;`lgF7=KAP`_Ci{&F=^0(&S&i)P?NPd9q?Rq@gc@^UdC8)Po2<5z@Ur z?pyQ=$(Y?8H1${*vh|M7MPc2jp+gcW1ZIA`Yvj;@kM(TiXR2?>D> z&|}5Niw?D-={<0K_m5bWL!eY{cKNRyApt2$8TSm=P0uMPsEqv5m<&+H)RuoL8p{z< z!*&4qNnH(@Y!)$veuBD5gU-mdJpsb0w6oF3bcR&xAkobTO3+-&g?WIqa7)F*N zM4AiB;@jh!neD#WCbIm^ZnavMYis^LB(%G!D7Wq$yQI`akwtS8)%c0(CL9^VBO^Vh z?%R$8sRb{)QUGDf^lM!XG{8%x>Y7}7=|9`>dtR&M`9`<>y)YN4h`3uH%$2azPV*JR zj|+~4nUUTV+mE3kKCu-Q%tB=7{QUgsigZE5$1%6-`HzFsn^)`c1b z=#TP%KP$$fv59g9PUJ>%^2V?D@=6u&E^u<_qE}!dz1hwU?x2A45k<7BTV#0qwxFme z1h_Sjn>f2dKO6chPQ{K@RQ;d|S`_3%tEa-=?W$jpgK!HOOT8r$tXbvJEVhS32e4$M&c@f>4GN5<-~VKRWg zniR&Dm=eyLd9?S02AldBpv(Z$OEMpLIFl%t?oicgZ=!32EI|Ait;xrLc-)~uaeeYCTs&GA=5L+G|6n%yW zPEJjn)=C>uJwRyT)Gd>|fK|O0AAHk#c-B1pbW-$}R2U8yMhM!ETG!dw+ixWr?J~2# zNy6uH?KE%=%afG@82jc=`*OOKXG~}cR@Q{Hu`wkrEiGTpkqgLxYc5ZRR z$4N-cK|d9` zWoElg%+-TV9+V5zcw|RTb{LR5tpQS@m9=1GX?+rq&5E(x>n@CCt0$p?GjRqKlnSFUjVXRWnYbsqIMY`OKP&bAC7xPc4#xd5qf+F#NJ zFwIKfj}W&K!U)qvg5QdiwG?--ut$1Uj#mB=uq7L=0#0qKW|o#f>t;a*o$Z%TbZ(Ym z9hWF^Ku+d;R-ioC9xL*+WWyU;Rs*wF(xGGL4(Q{^$XMyO`XCe;JmNrZiG0)|nox;q z&Sa>2TTa0im3)+fBOl2@4Z+%`NTvS+W=B)yV3x}_yN(G-DNvSTue*@2NdMC~&HvDQ zQd$SU6rFnde#?uEy{YfYz}{{1@(NR$x1SP|&uPg(Y!zf>=lLneNAO{{?Gun`uuvHb zlARpMF2&uQipsm&ll=&fAG90NS5zq~J>{#JoSK{*+`im!uHP3BpbZ(Ij`p1S15l18pl~VIl+sz zR5&YawymUTy4hLEK3Qk(`OctaF%xwMxF^N9+d4MEjC#_xD;>0Ut~arFyrRk+_{G$$`TL%Q zW8zV;mfkmR``ER@!^4}InSrV|vP$*=nD}eYlw}{KiYbN!#MjZ%>3KP3&h>c!6@zo% zUe_si`8^jFUA4LSz%n+B&~QmxXCnX$w3U7jh#IEBqa|4qAK((+hKPY)QfUQPUve++ zt)+nt2y3FKf|fk@sO2G)>r6CTXu`_G z)>CFF4x48cP<4xylD7X6Vs2Jw2vmVAM|#$5%<&1k`^!-x0}5a@=`GgpGzww+O=@;( z_CsmSo3B;@G~>x-6s`6Gd?n8+;7?cXmRue5caK`)FVXIZ8qjQVx@I8hwuEt_@Y!W# zkz1@IwOg@nB}3uqIV6214Rm8s(F#n%No7>gtrhEigA~6ZZV{?h{(3$lLc@NQBAJAu%do&=p0Gj1)aG2 z)cVeEI(|K72jI2E`)qJrFUrTxV$ZG00R77^bbZBANBBfr)IPOY_%C|0AxW!m}($7 zS!iOIcc5REJW-X+Kr1`C?OO=g0}~+ab!U?6#}CjS2UA0R<{tp>xU;`++VD~LlYU9t zHh6wApts(G;l<$X%KAVB_%)i40Ddnp`yU&)o?z3XyQ_C%%#clF;l0K(;`ciM4!)&l zxBFVq4aLsH?fc0-_nfDsriLz`D(BXkF1QLFwm4dOf#9rXb6iTEl(G1di1KF$#fG7Ib$L$bvbL_i!AjU5O%zT(?5oJd zbqMGLK?GK)j4Z?Cvup}7K2GZNFZZOVRtsjHJ}?$yC;>## z67ZdVe1H1Pbt}$&T9RPEdc|`ZRR+ovytIfIa4^i@9;OTKXJ^ClBPxuJ{#CvVyaXHk z6a3)IS73G>2i=B{o)28#{k9L$*Ee6V=_0cF*I+A)y#FADZe=us+v#c374NE!&IPfU zNl=Vx%&9|Aj8afLV~_B^sh&vlKwnXsznfB33%RT#cg{TLXP88a`eVGRGvKtv?>x;# z`0XQiUaS7RkOqAUgN^CvGu}Y`FeMgh!n+Co!u7K56aC!T1N)qpNhcPBQ4bq{hMs@{ zoZOj-fC*rQCk3+!_n+T%oA$i-Cdmtjf zE^yR#dlnkR@JM)-y|@B%4@3b6kP`$Wgufsv#(Ou#pa`ntf3>b7urD}=ZTt`*A1dKQ z?!Q4!{eYrGRg^14b|wy-dy?ph-BA~lXkt^w@Wz~z0|X>@(A|}y{xT&2iNv^1+arI7 zCu0PGHa7$sQ4pj*Cb)ma;!8MEsZeD|dg|&H#g>5EoX!sj8o~m}?!b~5?Z8$V)nipD z-IQuE;P}3IdLOghN#=9amrMpnRdflT+?|&%ABr3G!3EcpRheoB`;#ZRAQ%L3s4#63 zh|J{XV%!fr?!FdN`(70!kr=iD_wxSh%(-5FW8%ot)wbyKCL%nD0tYF9R6KW#Zg7_pu5bkS&Y`GQCJA$r43Bpi8S|XLD#Ef8!DegA@$~>nnl`jihX(IF> zm>_NOBA54sm@5yW$i*3Vr9n$ghhYVwe(V1#QIiTxdPuBP4C?uJ1bvDEWV8cU;f~PC z9TSnU$F7Y37Ve{(8yIQ8q5$@l`~n?n9I*Q4x70PZ`BPW4B^HQ{Di9@_(;>GlAoaxI$yVnd-&3 zh%ep=zzU)eTF!i329Ewg6A2V?kP$;9e<_u|2aNCLffB|ckJ@Yk4t}5t`jWk-Wlsm5dK z!1v4CXrU(Il(5UsmfT~QiAa~`cfn`F zU1_khhMGj{!m)w_;C-Wv&=9@HLw?eHUY~9XD3`N7ICb?(;0VJQ(JLY?oaz?r{!D-y zs#``IZHb+Yh(MpffJGR* z-Sm&q>k<9utQDnu$UNP}(?a>Yb&e2*A| zC>k^!=7Td*VQ-?;wl8GID27c`jx6~3*ZSBi`YMJoTJA-r6mX^*BqyaTSt(%@^uGYm C#&$RW literal 0 HcmV?d00001 diff --git a/packaging/flatpak/dev.echohello.Pidex.yml b/packaging/flatpak/dev.echohello.Pidex.yml new file mode 100644 index 0000000..c11acd9 --- /dev/null +++ b/packaging/flatpak/dev.echohello.Pidex.yml @@ -0,0 +1,47 @@ +app-id: dev.echohello.Pidex +runtime: org.freedesktop.Platform +runtime-version: '25.08' +sdk: org.freedesktop.Sdk +base: org.electronjs.Electron2.BaseApp +base-version: '25.08' +command: pidex +separate-locales: false +finish-args: + - --share=ipc + - --share=network + - --socket=fallback-x11 + - --socket=wayland + - --socket=pulseaudio + - --device=dri + - --filesystem=home + - --talk-name=org.freedesktop.Notifications +modules: + - name: pidex + buildsystem: simple + build-commands: + - install -Dm644 dev.echohello.Pidex.metainfo.xml /app/share/metainfo/dev.echohello.Pidex.metainfo.xml + - install -Dm644 dev.echohello.Pidex.desktop /app/share/applications/dev.echohello.Pidex.desktop + - install -Dm644 dev.echohello.Pidex.png /app/share/icons/hicolor/256x256/apps/dev.echohello.Pidex.png + - install -Dm755 pidex.sh /app/bin/pidex + sources: + - type: file + path: dev.echohello.Pidex.metainfo.xml + - type: file + path: dev.echohello.Pidex.desktop + - type: file + path: dev.echohello.Pidex.png + - type: file + path: pidex.sh + - type: extra-data + filename: pidex.AppImage + only-arches: + - x86_64 + url: https://github.com/echohello-dev/pidex/releases/download/2026.09.28-2/pidex-linux-x86_64.AppImage + sha256: d619aa5afbc7c1cac7146135d41510ed97b7bc819e957b7aa009e2a454eaab6b + size: 126532577 + - type: script + dest-filename: apply_extra + commands: + - chmod +x pidex.AppImage + - ./pidex.AppImage --appimage-extract + - mv squashfs-root pidex diff --git a/packaging/flatpak/flathub.json b/packaging/flatpak/flathub.json new file mode 100644 index 0000000..637604e --- /dev/null +++ b/packaging/flatpak/flathub.json @@ -0,0 +1,3 @@ +{ + "only-arches": ["x86_64"] +} diff --git a/packaging/flatpak/pidex.sh b/packaging/flatpak/pidex.sh new file mode 100755 index 0000000..8ef17f6 --- /dev/null +++ b/packaging/flatpak/pidex.sh @@ -0,0 +1,2 @@ +#!/bin/sh +exec zypak-wrapper /app/extra/pidex/pidex "$@" diff --git a/scripts/release-manifests.ts b/scripts/release-manifests.ts index a394107..eeced82 100644 --- a/scripts/release-manifests.ts +++ b/scripts/release-manifests.ts @@ -61,7 +61,7 @@ export function homebrewCask(tag: string, checksums: ReleaseChecksums): string { desc "Desktop workbench for the Pi coding agent" homepage "${REPO}" - depends_on macos: :sonoma + depends_on macos: :monterey app "pidex.app" @@ -150,7 +150,7 @@ export function latestHomebrewCask(): string { desc "Desktop workbench for the Pi coding agent" homepage "${REPO}" - depends_on macos: :sonoma + depends_on macos: :monterey app "pidex.app"