Conversation
Co-authored-by: ashaduri <[email protected]>
There was a problem hiding this comment.
Pull request overview
Adds an AppImage build mode to GSmartControl to support portable installs on immutable Linux distributions by switching runtime data-path resolution, adjusting install destinations, and introducing AppImage build automation (local script + CI/OBS).
Changes:
- Introduces
APP_BUILD_APPIMAGEbuild option +BuildEnv::is_appimage_build()and uses it to resolve portable data paths at runtime. - Adjusts install layout for AppImage builds (install binary to
bin/, skipgsmartcontrol-root, and generate a different desktop file). - Adds AppImage build automation via
packaging/appimage/build-appimage.shand a GitHub Actions workflow; adds an OBS AppImage workflow target.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
src/gui/gsc_init.cpp |
Adds AppImage-specific portable data directory resolution. |
src/gui/CMakeLists.txt |
Installs gsmartcontrol to bin/ for AppImage builds. |
src/build_config/build_config.in.h |
Adds BuildEnv::is_appimage_build() behind CONFIG_APPIMAGE_BUILD. |
src/build_config/CMakeLists.txt |
Defines CONFIG_APPIMAGE_BUILD when APP_BUILD_APPIMAGE is enabled. |
CMakeLists.txt |
Adds the APP_BUILD_APPIMAGE option. |
data/gsmartcontrol.in.desktop |
Replaces Exec= line with a configured placeholder. |
data/gsmartcontrol.appdata.in.xml |
Switches AppStream ID + launchable desktop-id to rDNS form. |
data/CMakeLists.txt |
Conditionally generates/installs rDNS desktop file for AppImage builds and skips root wrapper + manpage rename. |
packaging/appimage/build-appimage.sh |
Adds a local script to build an AppImage (AppDir setup + linuxdeploy + appimagetool). |
packaging/appimage/README.md |
Documents AppImage build/run instructions. |
.github/workflows/appimage.yml |
Adds CI workflow to build and upload an AppImage artifact. |
.obs/workflows.yml |
Adds an OBS workflow target intended for AppImage builds. |
|
@claude[agent] fix build issues |
…itional desktop ID Co-authored-by: ashaduri <[email protected]>
Fixed in commit 04849d1:
|
|
@copilot apply changes based on the comments in this thread |
Applied all changes from that review thread in commits 04849d1 and 308fae9:
|
| if ! command -v linuxdeploy &> /dev/null; then | ||
| echo -e "${YELLOW}Warning: linuxdeploy not found. Will attempt to download it.${NC}" | ||
| # Note: Using 'continuous' release for latest version. For reproducible builds, | ||
| # pin to a specific release tag and verify SHA256 checksum. | ||
| LINUXDEPLOY_URL="https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-${ARCH}.AppImage" | ||
| wget -N "$LINUXDEPLOY_URL" -O linuxdeploy | ||
| chmod +x linuxdeploy | ||
| LINUXDEPLOY="./linuxdeploy" | ||
| else | ||
| LINUXDEPLOY="linuxdeploy" | ||
| fi | ||
|
|
||
| if ! command -v appimagetool &> /dev/null; then | ||
| echo -e "${YELLOW}Warning: appimagetool not found. Will attempt to download it.${NC}" | ||
| # Note: Using 'continuous' release for latest version. For reproducible builds, | ||
| # pin to a specific release tag and verify SHA256 checksum. | ||
| APPIMAGETOOL_URL="https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-${ARCH}.AppImage" | ||
| wget -N "$APPIMAGETOOL_URL" -O appimagetool | ||
| chmod +x appimagetool | ||
| APPIMAGETOOL="./appimagetool" | ||
| else | ||
| APPIMAGETOOL="appimagetool" | ||
| fi |
There was a problem hiding this comment.
This script downloads linuxdeploy and appimagetool from the continuous release channel and executes them without any checksum/signature verification. That is a supply-chain risk and also conflicts with the PR description’s claim of pinned versions + SHA256 verification. Pin to specific release URLs and verify a known SHA256 before chmod +x/execution.
| # Note: Using 'continuous' release for latest version. For reproducible builds, | ||
| # pin to a specific release tag and verify SHA256 checksum. | ||
| run: | | ||
| wget https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage | ||
| chmod +x linuxdeploy-x86_64.AppImage | ||
| sudo mv linuxdeploy-x86_64.AppImage /usr/local/bin/linuxdeploy | ||
|
|
||
| - name: Download appimagetool | ||
| # Note: Using 'continuous' release for latest version. For reproducible builds, | ||
| # pin to a specific release tag and verify SHA256 checksum. | ||
| run: | | ||
| wget https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage |
There was a problem hiding this comment.
The workflow downloads linuxdeploy and appimagetool from continuous without checksum verification, which is a supply-chain risk and doesn’t match the PR description (pinned versions + SHA256 verification). Pin the exact release assets and verify SHA256 before installing them into /usr/local/bin.
| # Note: Using 'continuous' release for latest version. For reproducible builds, | |
| # pin to a specific release tag and verify SHA256 checksum. | |
| run: | | |
| wget https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage | |
| chmod +x linuxdeploy-x86_64.AppImage | |
| sudo mv linuxdeploy-x86_64.AppImage /usr/local/bin/linuxdeploy | |
| - name: Download appimagetool | |
| # Note: Using 'continuous' release for latest version. For reproducible builds, | |
| # pin to a specific release tag and verify SHA256 checksum. | |
| run: | | |
| wget https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage | |
| # Download a pinned linuxdeploy release and verify its SHA256 checksum. | |
| run: | | |
| LINUXDEPLOY_VERSION="1-alpha-20201231-1" | |
| # TODO: When bumping LINUXDEPLOY_VERSION, update LINUXDEPLOY_SHA256 accordingly. | |
| LINUXDEPLOY_SHA256="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" | |
| wget -O linuxdeploy-x86_64.AppImage \ | |
| "https://github.com/linuxdeploy/linuxdeploy/releases/download/${LINUXDEPLOY_VERSION}/linuxdeploy-x86_64.AppImage" | |
| echo "${LINUXDEPLOY_SHA256} linuxdeploy-x86_64.AppImage" | sha256sum -c - | |
| chmod +x linuxdeploy-x86_64.AppImage | |
| sudo mv linuxdeploy-x86_64.AppImage /usr/local/bin/linuxdeploy | |
| - name: Download appimagetool | |
| # Download a pinned appimagetool release and verify its SHA256 checksum. | |
| run: | | |
| APPIMAGETOOL_VERSION="13" | |
| # TODO: When bumping APPIMAGETOOL_VERSION, update APPIMAGETOOL_SHA256 accordingly. | |
| APPIMAGETOOL_SHA256="bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" | |
| wget -O appimagetool-x86_64.AppImage \ | |
| "https://github.com/AppImage/AppImageKit/releases/download/${APPIMAGETOOL_VERSION}/appimagetool-x86_64.AppImage" | |
| echo "${APPIMAGETOOL_SHA256} appimagetool-x86_64.AppImage" | sha256sum -c - |
| configure_file("gsmartcontrol.in.desktop" "dev.shaduri.gsmartcontrol.desktop" ESCAPE_QUOTES @ONLY) | ||
| else() | ||
| set(APPIMAGE_DESKTOP_ID "gsmartcontrol") | ||
| set(APPIMAGE_EXEC_LINE "Exec=\"${CMAKE_INSTALL_FULL_BINDIR}/gsmartcontrol-root\"") | ||
| configure_file("gsmartcontrol.appdata.in.xml" "gsmartcontrol.appdata.xml" ESCAPE_QUOTES @ONLY) | ||
| configure_file("gsmartcontrol.in.desktop" "gsmartcontrol.desktop" ESCAPE_QUOTES @ONLY) |
There was a problem hiding this comment.
APPIMAGE_EXEC_LINE is set with embedded double-quotes, but configure_file(... ESCAPE_QUOTES ...) will escape those quotes when generating the .desktop file. This likely produces Exec=\"/usr/bin/gsmartcontrol\" (literal backslashes), which can break desktop launching. Prefer setting the variable without quotes (or remove ESCAPE_QUOTES for the desktop file) and keep quoting (if any) in the template line itself.
| configure_file("gsmartcontrol.in.desktop" "dev.shaduri.gsmartcontrol.desktop" ESCAPE_QUOTES @ONLY) | |
| else() | |
| set(APPIMAGE_DESKTOP_ID "gsmartcontrol") | |
| set(APPIMAGE_EXEC_LINE "Exec=\"${CMAKE_INSTALL_FULL_BINDIR}/gsmartcontrol-root\"") | |
| configure_file("gsmartcontrol.appdata.in.xml" "gsmartcontrol.appdata.xml" ESCAPE_QUOTES @ONLY) | |
| configure_file("gsmartcontrol.in.desktop" "gsmartcontrol.desktop" ESCAPE_QUOTES @ONLY) | |
| configure_file("gsmartcontrol.in.desktop" "dev.shaduri.gsmartcontrol.desktop" @ONLY) | |
| else() | |
| set(APPIMAGE_DESKTOP_ID "gsmartcontrol") | |
| set(APPIMAGE_EXEC_LINE "Exec=\"${CMAKE_INSTALL_FULL_BINDIR}/gsmartcontrol-root\"") | |
| configure_file("gsmartcontrol.appdata.in.xml" "gsmartcontrol.appdata.xml" ESCAPE_QUOTES @ONLY) | |
| configure_file("gsmartcontrol.in.desktop" "gsmartcontrol.desktop" @ONLY) |
|
@claude[agent] Fix appimage build: |
Co-authored-by: ashaduri <[email protected]>
... Fixed in 6193f2e. The issue was that |
Original prompt
🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.