app-id: pl.deno.kir.szafirhostproxy
runtime: org.kde.Platform
runtime-version: '6.10'
sdk: org.kde.Sdk
command: szafir-host-proxy
sdk-extensions:
  - org.freedesktop.Sdk.Extension.openjdk25

finish-args:
  # Display server connections and IPC: Wayland socket, GPU device access (DRI), and POSIX
  # shared memory (--share=ipc).
  - --socket=wayland
  - --share=ipc
  - --device=dri
  # D-Bus name ownership and talk permissions for the proxy's well-known D-Bus service name,
  # system tray integration, and desktop notifications for smart card hotplug events.
  - --own-name=pl.deno.kir.szafirhostproxy
  - --talk-name=org.kde.StatusNotifierWatcher
  - --talk-name=org.freedesktop.Notifications
  # Browser configuration directories for native messaging host installation. Access required
  # during Landlock Phase 1 (limitOverrides) to install the native messaging manifest and
  # wrapper; dropped in Phase 2 (dropBrowserAccess) after installation completes.
  - --filesystem=~/.mozilla:create
  - --filesystem=~/.librewolf:create
  - --filesystem=~/.waterfox:create
  - --filesystem=xdg-config/google-chrome:create
  - --filesystem=xdg-config/google-chrome-unstable:create
  - --filesystem=xdg-config/chromium:create
  # Flatpak per-app override keyfiles directory (~/.local/share/flatpak/overrides). Required
  # for granting flatpak browsers installed on host access to proxy's Link interface to
  # facilitate seamless native host integration. Access is restricted to only specific
  # override files early in the runtime: Landlock Phase 1 covers all override files (browsers
  # + szafir apps); Phase 2 narrows to szafir app overrides only (browser files dropped).
  - --filesystem=~/.local/share/flatpak/overrides:rw
  # Read-only Flatpak icon export directories and application metadata paths. The
  # exports/share/icons directories are added to XDG_DATA_DIRS so that KIconLoader and Qt's
  # platform theme can resolve browser icons (e.g. firefox, google-chrome) in the system tray
  # and browser list. The flatpak/app directories are required because the icon export
  # directories contain symlinks that point back into flatpak/app/<id>/current/active/export/.
  - --filesystem=~/.local/share/flatpak/exports/share/icons:ro
  - --filesystem=/var/lib/flatpak/exports/share/icons:ro
  - --filesystem=~/.local/share/flatpak/app:ro
  - --filesystem=/var/lib/flatpak/app:ro
  # Flatpak per-app sandbox data directories for each supported browser (~/.var/app/<flatpak-
  # id>). Required to read and write the native messaging host manifest inside the browser's
  # Flatpak sandbox. Permissions dropped after verifying & installing manifests early at
  # runtime in Landlock Phase 2 (dropBrowserAccess).
  - --filesystem=~/.var/app/org.mozilla.firefox:create
  - --filesystem=~/.var/app/io.gitlab.librewolf-community:create
  - --filesystem=~/.var/app/net.waterfox.waterfox:create
  - --filesystem=~/.var/app/com.google.Chrome:create
  - --filesystem=~/.var/app/com.google.ChromeDev:create
  - --filesystem=~/.var/app/org.chromium.Chromium:create
  - --filesystem=~/.var/app/io.github.ungoogled_software.ungoogled_chromium:create
  # Additional permissions required for directly running the SzafirHost JVM process: X11
  # socket for the JVM Swing UI, PC/SC smartcard daemon for direct smartcard access, and
  # network access for component downloads and JVM communication.
  - --socket=x11
  - --socket=pcsc
  - --share=network
  # Java runtime working data: persistent ~/.java cache directory and the required environment
  # variables for the bundled OpenJDK runtime.
  - --persist=.java
  - --env=PATH=/app/jre/bin:/app/bin:/usr/bin
  - --env=JAVA_HOME=/app/jre

cleanup:
  - /include
  - /bin/pcsc-spy
  - /lib/libpcscspy*
  - /lib/pkgconfig
  - /share/doc
  - /share/man
  - /sbin

modules:
  - name: openjdk
    buildsystem: simple
    build-commands:
      - /usr/lib/sdk/openjdk25/install.sh

  - name: pcsc-lite
    buildsystem: meson
    config-opts:
      - -Dlibudev=false
      - -Dlibsystemd=false
      - -Dusb=false
      - -Dlibusb=false
      - -Dpolkit=false
      - -Dserial=false
      - -Dipcdir=/run/pcscd
      - --libdir=lib
    post-install:
      - install -Dm644 ../COPYING /app/share/licenses/$FLATPAK_ID/pcsc-lite/COPYING
    sources:
      - type: archive
        url: https://src.fedoraproject.org/repo/pkgs/pcsc-lite/pcsc-lite-2.3.3.tar.xz/sha512/96a62364eb0221828a5e3f65d500f8b83acc27cdc0c40fad2b0f807b399c1a465524421175bd7c05fa4ece152f9afe7f8b60c57ee20fa948af7d8899543a2d12/pcsc-lite-2.3.3.tar.xz
        sha256: cdff7d7153a0b37aa74e26dfec89ec7dc5c5286aa21b91b903e38739d227e8e7

  # Build-time dep: CMake configure runs generate_permissions_header.py (imports yaml);
  # the KDE SDK ships no yaml module, so vendor PyYAML into the prefix.
  - name: python3-pyyaml
    buildsystem: simple
    build-commands:
      - pip3 install --exists-action=i --no-index --find-links="file://${PWD}" --prefix=${FLATPAK_DEST} "PyYAML" --ignore-installed --no-build-isolation
    sources:
      - type: file
        url: https://files.pythonhosted.org/packages/05/8e/961c0007c59b8dd7729d542c61a4d537767a59645b82a0b521206e1e25c2/pyyaml-6.0.3.tar.gz
        sha256: d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f

  - name: szafir-host-proxy
    buildsystem: cmake-ninja
    config-opts:
      - -DAPP_ID=pl.deno.kir.szafirhostproxy
      - -DAPP_VERSION=0.5.6
      - -DSZAFIR_DEV=ON
    sources:
      - type: dir
        path: szafir-host-proxy
      - type: file
        path: szafir-host-proxy/LICENSE
      - type: file
        path: szafir-host-proxy/szafir_license_en.md
      - type: file
        path: szafir-host-proxy/szafir_license_pl.md

  - name: szafir-icons
    buildsystem: simple
    build-commands:
      - install -D -m 644 proxy_icon.svg /app/share/icons/hicolor/scalable/apps/pl.deno.kir.szafirhostproxy.svg
      - install -D -m 644 pl.deno.kir.szafirhostproxy.metainfo.xml /app/share/metainfo/pl.deno.kir.szafirhostproxy.metainfo.xml
      - install -D -m 644 pl.deno.kir.szafirhostproxy.desktop /app/share/applications/pl.deno.kir.szafirhostproxy.desktop
    sources:
      - type: file
        path: szafir-host-proxy/proxy_icon.svg
      - type: file
        path: szafir-host-proxy/pl.deno.kir.szafirhostproxy.metainfo.xml
      - type: file
        path: pl.deno.kir.szafirhostproxy.desktop