app-id: org.peergos.Peergos # The window is Electron, and the engine is bundled: a Chromium security fix # reaches users when we ship, not when they run flatpak update. That is the deal # we took to get an engine the apps can run on - WebKitGTK, which the GNOME # runtime provides, cannot render WebGL from a worker without deadlocking the # whole web process, which hangs vlc.js and weboffice. See electron.md. # # The base app is only zypak and libappindicator; Electron itself comes from the # archive below. Nothing here needs npm, so the build stays offline without a # vendored node tree. runtime: org.freedesktop.Platform runtime-version: "25.08" sdk: org.freedesktop.Sdk base: org.electronjs.Electron2.BaseApp base-version: "25.08" sdk-extensions: - org.freedesktop.Sdk.Extension.openjdk25 command: peergos finish-args: - --share=network - --share=ipc - --filesystem=~/.peergos:create - --filesystem=home - --talk-name=org.freedesktop.Flatpak - --talk-name=org.freedesktop.secrets # register the tray icon. No --own-name to go with it: tray.py registers under # the connection's unique name, as the SNI spec allows and as every host we # have met accepts, so it owns no well-known name at all. - --talk-name=org.kde.StatusNotifierWatcher # all, not dri and usb: a security key is spoken to over /dev/hidraw, which no # narrower permission reaches - --device=all - --socket=pulseaudio - --socket=cups - --socket=fallback-x11 - --socket=wayland - --env=PATH=/app/jre/bin:/app/bin:/usr/bin build-options: append-path: /usr/lib/sdk/openjdk25/bin env: JAVA_HOME: /usr/lib/sdk/openjdk25 cleanup: - "/app/ant" - "/app/bin/ant" - "/app/include" - "/app/lib/pkgconfig" - "/app/lib/libsecret/locale" - "*.la" - "*.a" modules: # secret-tool, used by FlatpakSecretToolStore to keep the mount password in the # user's keyring rather than in mount-config.json. The runtime ships libsecret # but not its CLI, so we build it here (library + tool, nothing else). - name: libsecret buildsystem: meson config-opts: # we don't ship libsecret's translations — park the .mo files out of the # way of the runtime's own locale dir, and drop them in cleanup. - -Dlocaledir=/app/lib/libsecret/locale - -Dmanpage=false - -Dvapi=false - -Dgtk_doc=false - -Dintrospection=false - -Dbash_completion=disabled sources: - type: archive url: https://download.gnome.org/sources/libsecret/0.21/libsecret-0.21.7.tar.xz sha256: 6b452e4750590a2b5617adc40026f28d2f4903de15f1250e1d1c40bfd68ed55e - name: openjdk buildsystem: simple build-commands: - /usr/lib/sdk/openjdk25/install.sh - name: ant buildsystem: simple build-commands: - ./build.sh - mkdir -p /app/ant - mkdir -p /app/bin - cp -r dist /app/ant - ln -s /app/ant/bin/ant /app/bin/ant sources: # vendored: downloads.apache.org times out often enough to fail the build, # and only carries current releases. archive.apache.org keeps this version # if it ever needs refetching. - type: archive path: apache-ant-1.10.17-src.tar.gz sha256: f0390a5cee1076077f9adb8feddd99331feba4a9887f3379992b8b6b27be645c # The browser engine. A prebuilt release rather than an npm install: nothing # in the window host has a dependency, so this is the only thing to fetch, and # flatpak-node-generator never has to enter the picture. Bumping it is the # security update path now that the runtime no longer provides the engine - # track electron stable and rebuild for its security releases, not only for # ours. - name: electron buildsystem: simple build-commands: - mkdir -p /app/electron - cp -r ./* /app/electron/ - chmod +x /app/electron/electron sources: - type: archive url: https://github.com/electron/electron/releases/download/v43.4.0/electron-v43.4.0-linux-x64.zip sha256: 7c5f7918bcae74a05a814543940eb28469c055edaa3cfcf41d0ff1787b314c52 strip-components: 0 # D-Bus for the tray process. Pure python and dependency free, which is the # whole reason it is this library and not pygobject: nothing to compile, and # the runtime's python3 is all it needs. Vendored like the ant tarball so the # build stays offline. - name: jeepney buildsystem: simple build-commands: # the window host's directory is the peergos module's to fill, and that # module is built after this one - mkdir -p /app/peergos-window - cp -r jeepney /app/peergos-window/jeepney - rm -rf /app/peergos-window/jeepney/tests - install -Dm644 LICENSE /app/share/licenses/jeepney/LICENSE sources: - type: archive path: jeepney-0.9.0.tar.gz sha256: cf0e9e845622b81e4a28df94c40345400256ec608d0e55bb8a3feaa9163f5732 - name: peergos buildsystem: simple build-commands: - export JAVA_HOME=/app/jdk - export PATH=$JAVA_HOME/bin:$PATH/app/jdk - ant dist - install -Dm644 server/Peergos.jar /app/share/peergos/Peergos.jar - install -Dm755 peergos.sh /app/bin/peergos - install -Dm644 packager/electron/main.js /app/peergos-window/main.js - install -Dm644 packager/electron/preload.js /app/peergos-window/preload.js - install -Dm644 packager/electron/package.json /app/peergos-window/package.json - install -Dm644 -t /app/peergos-window/icons packager/electron/icons/*.png # The tray, which main.js spawns as `python3 tray.py` from its own # directory - so it sits beside the icons it reads and the vendored # jeepney it imports. See tray.py for why the tray is not Electron's. - install -Dm644 packager/flatpak/peergos-tray.py /app/peergos-window/tray.py # DesktopApp.java spawns `peergos-window ` and shuts the server down # when it exits, so the name and the argument stay as they were. Chromium's # sandbox cannot set itself up inside a flatpak, so everything goes through # zypak, which redirects it to the portal. - install -Dm755 packager/flatpak/peergos-window.sh /app/bin/peergos-window - install -Dm644 packager/flatpak/org.peergos.Peergos.desktop /app/share/applications/org.peergos.Peergos.desktop - install -Dm644 packager/flatpak/peergos.svg /app/share/icons/hicolor/scalable/apps/org.peergos.Peergos.svg - install -Dm644 packager/flatpak/org.peergos.Peergos.metainfo.xml /app/share/metainfo/org.peergos.Peergos.metainfo.xml sources: - type: git url: http://github.com/peergos/web-ui.git commit: a6526c84e12d77638cd2a069fdaa579084663936 - type: file path: peergos.sh