diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml index 393a3d48e..febe7951b 100644 --- a/.github/workflows/desktop-build.yml +++ b/.github/workflows/desktop-build.yml @@ -129,7 +129,7 @@ jobs: fi - name: Build Tauri App (Linux, signed updater) - run: nix develop .#ci -c ./scripts/ci/desktop-release.sh + run: nix develop .#desktop-linux -c ./scripts/ci/desktop-release.sh env: APPIMAGE_EXTRACT_AND_RUN: "1" NO_STRIP: "true" @@ -138,11 +138,11 @@ jobs: - name: Show sccache stats if: always() - run: nix develop .#ci -c sccache --show-stats + run: nix develop .#desktop-linux -c sccache --show-stats - name: Collect Linux release checksums run: | - nix develop .#ci -c ./scripts/ci/attestation-manifest.sh \ + nix develop .#desktop-linux -c ./scripts/ci/attestation-manifest.sh \ desktop-linux-artifacts.sha256 \ frontend/src-tauri/target/reproducibility/desktop-release-linux-final.sha256 \ frontend/src-tauri/target/reproducibility/desktop-release-linux-*.sha256 diff --git a/.github/workflows/desktop-pr-build.yml b/.github/workflows/desktop-pr-build.yml index 1efea1aab..4cba67b17 100644 --- a/.github/workflows/desktop-pr-build.yml +++ b/.github/workflows/desktop-pr-build.yml @@ -100,13 +100,13 @@ jobs: fi - name: Build Tauri App (Linux, unsigned + fake updater signing) - run: nix develop .#ci -c ./scripts/ci/desktop-pr.sh + run: nix develop .#desktop-linux -c ./scripts/ci/desktop-pr.sh env: MAPLE_TAURI_FAKE_UPDATER_SIGNING: "1" - name: Show sccache stats if: always() - run: nix develop .#ci -c sccache --show-stats + run: nix develop .#desktop-linux -c sccache --show-stats - name: Upload Linux PR Builds uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9ac206029..5a268a111 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -48,7 +48,7 @@ jobs: nix_shell: ci artifact_prefix: macos - platform: ubuntu-latest-8-cores - nix_shell: ci + nix_shell: desktop-linux artifact_prefix: linux runs-on: ${{ matrix.platform }} diff --git a/flake.nix b/flake.nix index 4e4ab0076..273c76d56 100644 --- a/flake.nix +++ b/flake.nix @@ -300,24 +300,38 @@ url = "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/tauri-apps/binary-releases/releases/download/apprun-old/AppRun-${arch}"; hash = linuxTauriToolHashes.appRun.${arch}; }; + appimagePluginSources = { + aarch64 = ./nix/vendor/linuxdeploy-plugin-appimage/linuxdeploy-plugin-appimage-aarch64.AppImage; + x86_64 = ./nix/vendor/linuxdeploy-plugin-appimage/linuxdeploy-plugin-appimage-x86_64.AppImage; + }; + appimageRuntimeSources = { + aarch64 = ./nix/vendor/appimage-type2-runtime/runtime-aarch64; + x86_64 = ./nix/vendor/appimage-type2-runtime/runtime-x86_64; + }; linuxdeploy = pkgs.fetchurl { url = "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/tauri-apps/binary-releases/releases/download/linuxdeploy/linuxdeploy-${linuxdeployArch}.AppImage"; hash = linuxTauriToolHashes.linuxdeploy.${linuxdeployArch}; }; - appimagePlugin = pkgs.fetchurl { - url = "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/linuxdeploy/linuxdeploy-plugin-appimage/releases/download/continuous/linuxdeploy-plugin-appimage-${arch}.AppImage"; - hash = linuxTauriToolHashes.appimagePlugin.${arch}; - }; - appimageRuntime = pkgs.fetchurl { - url = "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/AppImage/type2-runtime/releases/download/continuous/runtime-${arch}"; - hash = linuxTauriToolHashes.appimageRuntime.${arch}; - }; + appimagePlugin = pkgs.runCommand "linuxdeploy-plugin-appimage-${arch}.AppImage" { + outputHashAlgo = "sha256"; + outputHashMode = "flat"; + outputHash = linuxTauriToolHashes.appimagePlugin.${arch}; + } '' + install -m 0644 ${appimagePluginSources.${arch}} "$out" + ''; + appimageRuntime = pkgs.runCommand "appimage-runtime-${arch}" { + outputHashAlgo = "sha256"; + outputHashMode = "flat"; + outputHash = linuxTauriToolHashes.appimageRuntime.${arch}; + } '' + install -m 0644 ${appimageRuntimeSources.${arch}} "$out" + ''; gtkPlugin = pkgs.fetchurl { - url = "https://raw.githubusercontent.com/tauri-apps/linuxdeploy-plugin-gtk/master/linuxdeploy-plugin-gtk.sh"; + url = "https://raw.githubusercontent.com/tauri-apps/linuxdeploy-plugin-gtk/b5eb8d05b4c0ed40107fe2158c5d8527f94568ef/linuxdeploy-plugin-gtk.sh"; hash = linuxTauriToolHashes.gtkPlugin; }; gstreamerPlugin = pkgs.fetchurl { - url = "https://raw.githubusercontent.com/tauri-apps/linuxdeploy-plugin-gstreamer/master/linuxdeploy-plugin-gstreamer.sh"; + url = "https://raw.githubusercontent.com/tauri-apps/linuxdeploy-plugin-gstreamer/2a2e67491c32995a3f279ad0ecbe77abd512b42a/linuxdeploy-plugin-gstreamer.sh"; hash = linuxTauriToolHashes.gstreamerPlugin; }; linuxdeployWrapperSource = pkgs.writeText "maple-linuxdeploy-wrapper.c" '' @@ -535,8 +549,6 @@ export MAPLE_NIX_GTK_LIB=${pkgs.gtk3}/lib export MAPLE_NIX_LINUX_CLOSURE_INFO=${linuxRuntimeClosure} export MAPLE_NIX_LINUXDEPLOY_SUPPORT_PATH=${lib.makeBinPath linuxdeploySupportPackages} - ${lib.optionalString (tauriLinuxdeployTools != null) "export MAPLE_NIX_TAURI_LINUXDEPLOY_TOOLS=${tauriLinuxdeployTools}"} - ${lib.optionalString (linuxTauriToolsArch != null) "export MAPLE_NIX_TAURI_LINUXDEPLOY_ARCH=${linuxTauriToolsArch}"} export GSTREAMER_PLUGINS_DIR=${gstreamerPlugins}/lib/gstreamer-1.0 export GSTREAMER_HELPERS_DIR=${pkgs.gst_all_1.gstreamer.out}/libexec/gstreamer-1.0 export __EGL_VENDOR_LIBRARY_FILENAMES=${pkgs.mesa}/share/glvnd/egl_vendor.d/50_mesa.json @@ -547,6 +559,11 @@ export GIO_MODULE_DIR=${pkgs.glib-networking}/lib/gio/modules ''; + linuxDesktopShellHook = lib.optionalString pkgs.stdenv.isLinux '' + ${lib.optionalString (tauriLinuxdeployTools != null) "export MAPLE_NIX_TAURI_LINUXDEPLOY_TOOLS=${tauriLinuxdeployTools}"} + ${lib.optionalString (linuxTauriToolsArch != null) "export MAPLE_NIX_TAURI_LINUXDEPLOY_ARCH=${linuxTauriToolsArch}"} + ''; + androidShellHook = lib.optionalString supportsAndroidHost '' export JAVA_HOME=${jdk} export ANDROID_HOME=${androidComposition.androidsdk}/libexec/android-sdk @@ -593,6 +610,8 @@ }) // { meta.description = "Run ${script} through nix develop .#${shell}"; }; + + desktopCiShell = if pkgs.stdenv.isLinux then "desktop-linux" else "ci"; in { devShells = { @@ -602,7 +621,7 @@ in mkShellForHost { packages = shellPackages; - shellHook = pathShellHook shellPackages + commonShellHook + linuxShellHook; + shellHook = pathShellHook shellPackages + commonShellHook + linuxShellHook + linuxDesktopShellHook; }; ci = @@ -615,6 +634,15 @@ }; } // lib.optionalAttrs pkgs.stdenv.isLinux { + desktop-linux = + let + shellPackages = ciPackages ++ [ jdk ] ++ linuxTauriPackages; + in + mkShellForHost { + packages = shellPackages; + shellHook = pathShellHook shellPackages + commonShellHook + linuxShellHook + linuxDesktopShellHook; + }; + android = let shellPackages = ciPackages ++ androidPackages; @@ -676,9 +704,9 @@ apps = { ci-frontend = mkNixApp "maple-ci-frontend" "ci" "./scripts/ci/frontend.sh"; ci-rust = mkNixApp "maple-ci-rust" "ci" "./scripts/ci/rust.sh"; - ci-desktop-pr = mkNixApp "maple-ci-desktop-pr" "ci" "./scripts/ci/desktop-pr.sh"; - ci-desktop-release = mkNixApp "maple-ci-desktop-release" "ci" "./scripts/ci/desktop-release.sh"; - ci-signed-desktop-release-rehearsal = mkNixApp "maple-ci-signed-desktop-release-rehearsal" "ci" "./scripts/ci/signed-release-rehearsal.sh desktop"; + ci-desktop-pr = mkNixApp "maple-ci-desktop-pr" desktopCiShell "./scripts/ci/desktop-pr.sh"; + ci-desktop-release = mkNixApp "maple-ci-desktop-release" desktopCiShell "./scripts/ci/desktop-release.sh"; + ci-signed-desktop-release-rehearsal = mkNixApp "maple-ci-signed-desktop-release-rehearsal" desktopCiShell "./scripts/ci/signed-release-rehearsal.sh desktop"; ci-latest-json = mkNixApp "maple-ci-latest-json" "ci" "./scripts/ci/latest-json.sh"; ci-verify-release-artifacts = mkNixApp "maple-ci-verify-release-artifacts" "ci" "./scripts/ci/verify-release-artifacts.sh"; } diff --git a/nix/vendor/README.md b/nix/vendor/README.md new file mode 100644 index 000000000..8907cecdd --- /dev/null +++ b/nix/vendor/README.md @@ -0,0 +1,23 @@ +Vendored Nix inputs +=================== + +These files are binary build inputs for Linux AppImage packaging. They are +checked into the flake source because the upstream `continuous` release assets +are mutable, which broke fixed-output hash verification on clean CI runners. + +Nix still verifies each vendored file with the hashes in `flake.nix`. + +- `linuxdeploy-plugin-appimage/linuxdeploy-plugin-appimage-x86_64.AppImage` + - Source: `linuxdeploy/linuxdeploy-plugin-appimage` Actions run `25200823721`, + artifact `6744621518` (`AppImage-x86_64`) + - Hash: `sha256-Egjmp7HiZG4/sAbeqQC3K9hI7IYyS5l5t8lD8hHGacg=` +- `linuxdeploy-plugin-appimage/linuxdeploy-plugin-appimage-aarch64.AppImage` + - Source: `linuxdeploy/linuxdeploy-plugin-appimage` Actions run `25200823721`, + artifact `6744622485` (`AppImage-aarch64`) + - Hash: `sha256-Ak4f3LJchgv9hSN5I6lO0VubrAwCqQ/xCpCcsIdmxfU=` +- `appimage-type2-runtime/runtime-x86_64` + - Source: `AppImage/type2-runtime` continuous release asset + - Hash: `sha256-okGdzkdWg5WuecAf+ppaNB3TOVgTUv8QTQc1J1Qxd+U=` +- `appimage-type2-runtime/runtime-aarch64` + - Source: `AppImage/type2-runtime` continuous release asset + - Hash: `sha256-fyeowVvyCi5GNC6kqXcEemnYtNZKEj/gteI7IP0pDIU=` diff --git a/nix/vendor/appimage-type2-runtime/runtime-aarch64 b/nix/vendor/appimage-type2-runtime/runtime-aarch64 new file mode 100644 index 000000000..ffe95a651 Binary files /dev/null and b/nix/vendor/appimage-type2-runtime/runtime-aarch64 differ diff --git a/nix/vendor/appimage-type2-runtime/runtime-x86_64 b/nix/vendor/appimage-type2-runtime/runtime-x86_64 new file mode 100644 index 000000000..4e3b1f71b Binary files /dev/null and b/nix/vendor/appimage-type2-runtime/runtime-x86_64 differ diff --git a/nix/vendor/linuxdeploy-plugin-appimage/linuxdeploy-plugin-appimage-aarch64.AppImage b/nix/vendor/linuxdeploy-plugin-appimage/linuxdeploy-plugin-appimage-aarch64.AppImage new file mode 100644 index 000000000..a6fdf4dbb Binary files /dev/null and b/nix/vendor/linuxdeploy-plugin-appimage/linuxdeploy-plugin-appimage-aarch64.AppImage differ diff --git a/nix/vendor/linuxdeploy-plugin-appimage/linuxdeploy-plugin-appimage-x86_64.AppImage b/nix/vendor/linuxdeploy-plugin-appimage/linuxdeploy-plugin-appimage-x86_64.AppImage new file mode 100644 index 000000000..17918eef2 Binary files /dev/null and b/nix/vendor/linuxdeploy-plugin-appimage/linuxdeploy-plugin-appimage-x86_64.AppImage differ