feat: publish Flatpak to our own signed repo on each release

.github/workflows/electron.yml

@@ -293,7 +293,7 @@ jobs:
       - name: Install system dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libfuse2 flatpak flatpak-builder imagemagick
+          sudo apt-get install -y libfuse2
 
       - name: Install dependencies
         run: |
@@ -426,89 +426,6 @@ jobs:
           path: release/termix_linux_armv7l_portable.tar.gz
           retention-days: 30
 
-      - name: Add Flathub repository
-        run: |
-          sudo flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
-
-      - name: Install Flatpak runtime and SDK
-        run: |
-          sudo flatpak install -y flathub org.freedesktop.Platform//24.08
-          sudo flatpak install -y flathub org.freedesktop.Sdk//24.08
-          sudo flatpak install -y flathub org.electronjs.Electron2.BaseApp//24.08
-
-      - name: Get version for Flatpak
-        id: flatpak-version
-        run: |
-          VERSION="${{ inputs.version_override }}"
-          if [ -z "$VERSION" ]; then
-            VERSION=$(node -p "require('./package.json').version")
-          fi
-          RELEASE_DATE=$(date +%Y-%m-%d)
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "release_date=$RELEASE_DATE" >> $GITHUB_OUTPUT
-
-      - name: Prepare Flatpak files
-        run: |
-          VERSION="${{ steps.flatpak-version.outputs.version }}"
-          RELEASE_DATE="${{ steps.flatpak-version.outputs.release_date }}"
-
-          CHECKSUM_X64=$(sha256sum "release/termix_linux_x64_appimage.AppImage" | awk '{print $1}')
-          CHECKSUM_ARM64=$(sha256sum "release/termix_linux_arm64_appimage.AppImage" | awk '{print $1}')
-
-          mkdir -p flatpak-build
-          cp packaging/flatpak/com.karmaa.termix.yml flatpak-build/
-          cp packaging/flatpak/com.karmaa.termix.desktop flatpak-build/
-          cp packaging/flatpak/com.karmaa.termix.metainfo.xml flatpak-build/
-          cp public/icon.svg flatpak-build/com.karmaa.termix.svg
-          convert public/icon.png -resize 256x256 flatpak-build/icon-256.png
-          convert public/icon.png -resize 128x128 flatpak-build/icon-128.png
-
-          cd flatpak-build
-          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/vVERSION_PLACEHOLDER/termix_linux_x64_appimage.AppImage|file://$(realpath ../release/termix_linux_x64_appimage.AppImage)|g" com.karmaa.termix.yml
-          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/vVERSION_PLACEHOLDER/termix_linux_arm64_appimage.AppImage|file://$(realpath ../release/termix_linux_arm64_appimage.AppImage)|g" com.karmaa.termix.yml
-          sed -i "s/CHECKSUM_X64_PLACEHOLDER/$CHECKSUM_X64/g" com.karmaa.termix.yml
-          sed -i "s/CHECKSUM_ARM64_PLACEHOLDER/$CHECKSUM_ARM64/g" com.karmaa.termix.yml
-          sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" com.karmaa.termix.metainfo.xml
-          sed -i "s/DATE_PLACEHOLDER/$RELEASE_DATE/g" com.karmaa.termix.metainfo.xml
-
-      - name: Build Flatpak bundle
-        run: |
-          cd flatpak-build
-          flatpak-builder --repo=repo --force-clean --disable-rofiles-fuse build-dir com.karmaa.termix.yml
-
-          ARCH=$(uname -m)
-          if [ "$ARCH" = "x86_64" ]; then
-            FLATPAK_ARCH="x86_64"
-          elif [ "$ARCH" = "aarch64" ]; then
-            FLATPAK_ARCH="aarch64"
-          else
-            FLATPAK_ARCH="$ARCH"
-          fi
-
-          flatpak build-bundle repo ../release/termix_linux_flatpak.flatpak com.karmaa.termix --runtime-repo=https://flathub.org/repo/flathub.flatpakrepo
-
-      - name: Create flatpakref file
-        run: |
-          VERSION="${{ steps.flatpak-version.outputs.version }}"
-          cp packaging/flatpak/com.karmaa.termix.flatpakref release/
-          sed -i "s|VERSION_PLACEHOLDER|v${VERSION}|g" release/com.karmaa.termix.flatpakref
-
-      - name: Upload Flatpak bundle
-        uses: actions/upload-artifact@v7
-        if: hashFiles('release/termix_linux_flatpak.flatpak') != '' && inputs.artifact_destination != 'none'
-        with:
-          name: termix_linux_flatpak
-          path: release/termix_linux_flatpak.flatpak
-          retention-days: 30
-
-      - name: Upload Flatpakref
-        uses: actions/upload-artifact@v7
-        if: hashFiles('release/com.karmaa.termix.flatpakref') != '' && inputs.artifact_destination != 'none'
-        with:
-          name: termix_linux_flatpakref
-          path: release/com.karmaa.termix.flatpakref
-          retention-days: 30
-
       # Every official plugin, for installs without internet. No update files.
       - name: Build Linux x64 full packages
         if: inputs.artifact_destination != 'none'

.github/workflows/flatpak.yml

@@ -0,0 +1,112 @@
+name: Publish Flatpak
+
+# Builds the Flatpak from a release's portable tarballs and adds the bundles to
+# that release. Stable releases also replace the repo at flatpak.termix.site,
+# which is what `flatpak update` reads.
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: "Release tag to package, like v26.11.1"
+        required: true
+        type: string
+      publish:
+        description: "Replace the live Flatpak repo"
+        required: true
+        default: true
+        type: boolean
+  workflow_call:
+    inputs:
+      release_tag:
+        description: "Release tag to package"
+        required: true
+        type: string
+      publish:
+        description: "Replace the live Flatpak repo"
+        required: true
+        type: boolean
+
+env:
+  FLATPAK_REPO_URL: https://flatpak.termix.site
+
+jobs:
+  build:
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.release_tag }}
+          fetch-depth: 1
+
+      # A tag from before this workflow has no build script.
+      - name: Use the newest packaging files
+        env:
+          WORKFLOW_SHA: ${{ github.sha }}
+        run: |
+          git fetch --depth 1 origin "$WORKFLOW_SHA"
+          git checkout "$WORKFLOW_SHA" -- packaging/flatpak
+
+      - name: Install tools
+        run: |
+          sudo add-apt-repository -y ppa:flatpak/stable
+          sudo apt-get update
+          sudo apt-get install -y flatpak flatpak-builder imagemagick qemu-user-static
+          flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+
+      - name: Download release tarballs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.release_tag }}
+        run: |
+          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --dir tarballs \
+            --pattern termix_linux_x64_portable.tar.gz \
+            --pattern termix_linux_arm64_portable.tar.gz
+
+      - name: Import signing key
+        env:
+          FLATPAK_GPG_KEY: ${{ secrets.FLATPAK_GPG_KEY }}
+        run: |
+          export GNUPGHOME="$RUNNER_TEMP/gnupg"
+          mkdir -m 700 "$GNUPGHOME"
+          printf '%s' "$FLATPAK_GPG_KEY" | gpg --batch --import
+          echo "FLATPAK_GPG_HOME=$GNUPGHOME" >> "$GITHUB_ENV"
+          echo "FLATPAK_GPG_KEY_ID=$(gpg --list-keys --with-colons | awk -F: '/^fpr/ { print $10; exit }')" >> "$GITHUB_ENV"
+
+      - name: Build
+        env:
+          TAG: ${{ inputs.release_tag }}
+        run: |
+          bash packaging/flatpak/build-repo.sh "${TAG#v}" tarballs out
+          chmod -R a+rX out/site
+
+      - name: Add bundles to the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.release_tag }}
+        run: |
+          gh release upload "$TAG" out/*.flatpak out/com.karmaa.termix.flatpakref \
+            --repo "$GITHUB_REPOSITORY" --clobber
+
+      - name: Upload repo for Pages
+        if: inputs.publish
+        uses: actions/upload-pages-artifact@v5
+        with:
+          path: out/site
+
+  deploy:
+    needs: build
+    if: inputs.publish
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ env.FLATPAK_REPO_URL }}
+    steps:
+      - name: Deploy
+        uses: actions/deploy-pages@v5

.github/workflows/release.yml

@@ -543,6 +543,19 @@ jobs:
       source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.translate.outputs.sha || needs.prep.outputs.sha }}
     secrets: inherit
 
+  flatpak:
+    needs: [prep, electron-release]
+    if: ${{ always() && needs.electron-release.result == 'success' && needs.prep.outputs.mode != 'Dry run' }}
+    permissions:
+      contents: write
+      pages: write
+      id-token: write
+    uses: ./.github/workflows/flatpak.yml
+    with:
+      release_tag: ${{ needs.prep.outputs.release_tag }}
+      publish: ${{ needs.prep.outputs.channel == 'Stable' }}
+    secrets: inherit
+
   electron-submit:
     needs: [prep, merge-to-main, electron-release]
     if: ${{ always() && needs.electron-release.result == 'success' && needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' && needs.prep.outputs.mode != 'Skip submit' }}

CHANGELOG.md

@@ -22,6 +22,7 @@
 - Host status, import and export, and credential tools now start on for new installs
 - Sync now starts on in a new desktop app, so it can link to a server
 - The first run plugin picker leaves plugins you did not choose off instead of removing them
+- The Linux Flatpak now installs from flatpak.termix.site on x86_64 and arm64, and `flatpak update` keeps it current
 - Dropdowns and text areas are the same size as the text fields next to them
 - A page's own tabs sit above its search bar
 

packaging/flatpak/build-repo.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Builds a signed Flatpak repo and bundle from the release's portable tarballs.
+# Usage: build-repo.sh <version> <tarball dir> <output dir>
+# Env: FLATPAK_GPG_KEY_ID, FLATPAK_GPG_HOME, FLATPAK_REPO_URL, FLATPAK_ARCHES (optional)
+set -euo pipefail
+
+VERSION="$1"
+TARBALLS="$(realpath "$2")"
+mkdir -p "$3"
+OUTPUT="$(realpath "$3")"
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+ARCHES="${FLATPAK_ARCHES:-x86_64 aarch64}"
+APP_ID=com.karmaa.termix
+WORK="$OUTPUT/.work"
+rm -rf "$WORK"
+mkdir -p "$WORK"
+trap 'rm -rf "$WORK"' EXIT
+
+cd "$WORK"
+cp "$ROOT"/packaging/flatpak/$APP_ID.{yml,desktop,metainfo.xml} .
+cp "$ROOT/public/icon.svg" "$APP_ID.svg"
+convert "$ROOT/public/icon.png" -resize 256x256 icon-256.png
+convert "$ROOT/public/icon.png" -resize 128x128 icon-128.png
+cp "$TARBALLS/termix_linux_x64_portable.tar.gz" termix-x86_64.tar.gz
+cp "$TARBALLS/termix_linux_arm64_portable.tar.gz" termix-aarch64.tar.gz
+
+sed -i "s/VERSION_PLACEHOLDER/$VERSION/g; s/DATE_PLACEHOLDER/$(date +%Y-%m-%d)/g" "$APP_ID.metainfo.xml"
+
+for arch in $ARCHES; do
+  flatpak-builder --user --arch="$arch" --install-deps-from=flathub \
+    --default-branch=stable --force-clean --disable-rofiles-fuse --repo=repo \
+    --gpg-sign="$FLATPAK_GPG_KEY_ID" --gpg-homedir="$FLATPAK_GPG_HOME" \
+    "build-$arch" "$APP_ID.yml"
+done
+
+flatpak build-update-repo --title=Termix --default-branch=stable \
+  --generate-static-deltas --prune \
+  --gpg-sign="$FLATPAK_GPG_KEY_ID" --gpg-homedir="$FLATPAK_GPG_HOME" repo
+
+gpg --homedir "$FLATPAK_GPG_HOME" --export "$FLATPAK_GPG_KEY_ID" > termix.gpg
+GPG_KEY="$(base64 -w0 termix.gpg)"
+
+for arch in $ARCHES; do
+  name=termix_linux_flatpak.flatpak
+  [ "$arch" = x86_64 ] || name="termix_linux_${arch}_flatpak.flatpak"
+  flatpak build-bundle repo "$OUTPUT/$name" "$APP_ID" stable --arch="$arch" \
+    --repo-url="$FLATPAK_REPO_URL" --gpg-keys=termix.gpg \
+    --runtime-repo=https://flathub.org/repo/flathub.flatpakrepo
+done
+
+mv repo "$OUTPUT/site"
+for file in $APP_ID.flatpakref termix.flatpakrepo; do
+  sed "s|REPO_URL_PLACEHOLDER|$FLATPAK_REPO_URL|; s|GPG_KEY_PLACEHOLDER|$GPG_KEY|" \
+    "$ROOT/packaging/flatpak/$file" > "$OUTPUT/site/$file"
+done
+cp "$OUTPUT/site/$APP_ID.flatpakref" "$OUTPUT/"

packaging/flatpak/com.karmaa.termix.flatpakref

@@ -1,10 +1,12 @@
 [Flatpak Ref]
-Name=Termix
+Name=com.karmaa.termix
 Branch=stable
 Title=Termix
 IsRuntime=false
-Url=https://github.com/Termix-SSH/Termix/releases/download/VERSION_PLACEHOLDER/termix_linux_flatpak.flatpak
+Url=REPO_URL_PLACEHOLDER
+SuggestRemoteName=termix
 RuntimeRepo=https://flathub.org/repo/flathub.flatpakrepo
+GPGKey=GPG_KEY_PLACEHOLDER
 Comment=Self-hosted, plugin-based server management.
 Description=Termix is a free, open source, self-hosted platform for managing your servers, built on plugins. The core keeps your hosts, credentials, users and sharing, and plugins add the SSH terminal, remote desktop (RDP, VNC, Telnet), file manager, tunnels, Docker, metrics and more. It runs on web, desktop and mobile, and it is a free, self-hosted alternative to Termius.
 Icon=https://raw.githubusercontent.com/Termix-SSH/Termix/main/public/icon.png

packaging/flatpak/com.karmaa.termix.metainfo.xml

@@ -7,7 +7,9 @@
     <metadata_license>CC0-1.0</metadata_license>
     <project_license>Apache-2.0</project_license>
 
-    <developer_name>bugattiguy527</developer_name>
+    <developer id="site.termix">
+        <name>Termix</name>
+    </developer>
 
     <description>
         <p>
@@ -59,9 +61,6 @@
 
     </keywords>
 
-    <provides>
-        <binary>termix</binary>
-    </provides>
 
     <requires>
         <internet>always</internet>

packaging/flatpak/com.karmaa.termix.yml

@@ -1,9 +1,9 @@
 app-id: com.karmaa.termix
 runtime: org.freedesktop.Platform
-runtime-version: "24.08"
+runtime-version: "26.08"
 sdk: org.freedesktop.Sdk
 base: org.electronjs.Electron2.BaseApp
-base-version: "24.08"
+base-version: "26.08"
 command: run.sh
 separate-locales: false
 
@@ -26,52 +26,39 @@ finish-args:
 modules:
   - name: termix
     buildsystem: simple
+    build-options:
+      no-debuginfo: true
+      strip: false
     build-commands:
-      - chmod +x termix.AppImage
+      - rm -f app/chrome-sandbox
-      - ./termix.AppImage --appimage-extract
+      - mkdir -p /app/termix
-
+      - cp -a app/. /app/termix/
-      - install -Dm755 squashfs-root/termix /app/bin/termix
-      - cp -r squashfs-root/resources /app/bin/
-      - cp -r squashfs-root/locales /app/bin/ || true
-
-      - cp squashfs-root/*.so /app/bin/ || true
-      - cp squashfs-root/*.pak /app/bin/ || true
-      - cp squashfs-root/*.bin /app/bin/ || true
-      - cp squashfs-root/*.dat /app/bin/ || true
-      - cp squashfs-root/*.json /app/bin/ || true
-
-      - |
-        cat > run.sh << 'EOF'
-        #!/bin/bash
-        export TMPDIR="$XDG_RUNTIME_DIR/app/$FLATPAK_ID"
-        exec zypak-wrapper /app/bin/termix "$@"
-        EOF
-      - chmod +x run.sh
       - install -Dm755 run.sh /app/bin/run.sh
-
       - install -Dm644 com.karmaa.termix.desktop /app/share/applications/com.karmaa.termix.desktop
-
       - install -Dm644 com.karmaa.termix.metainfo.xml /app/share/metainfo/com.karmaa.termix.metainfo.xml
-
       - install -Dm644 com.karmaa.termix.svg /app/share/icons/hicolor/scalable/apps/com.karmaa.termix.svg
-      - install -Dm644 icon-256.png /app/share/icons/hicolor/256x256/apps/com.karmaa.termix.png || true
+      - install -Dm644 icon-256.png /app/share/icons/hicolor/256x256/apps/com.karmaa.termix.png
-      - install -Dm644 icon-128.png /app/share/icons/hicolor/128x128/apps/com.karmaa.termix.png || true
+      - install -Dm644 icon-128.png /app/share/icons/hicolor/128x128/apps/com.karmaa.termix.png
 
     sources:
-      - type: file
+      - type: archive
-        url: https://github.com/Termix-SSH/Termix/releases/download/vVERSION_PLACEHOLDER/termix_linux_x64_appimage.AppImage
+        path: termix-x86_64.tar.gz
-        sha256: CHECKSUM_X64_PLACEHOLDER
+        dest: app
-        dest-filename: termix.AppImage
         only-arches:
           - x86_64
 
-      - type: file
+      - type: archive
-        url: https://github.com/Termix-SSH/Termix/releases/download/vVERSION_PLACEHOLDER/termix_linux_arm64_appimage.AppImage
+        path: termix-aarch64.tar.gz
-        sha256: CHECKSUM_ARM64_PLACEHOLDER
+        dest: app
-        dest-filename: termix.AppImage
         only-arches:
           - aarch64
 
+      - type: script
+        dest-filename: run.sh
+        commands:
+          - export TMPDIR="$XDG_RUNTIME_DIR/app/$FLATPAK_ID"
+          - exec zypak-wrapper /app/termix/termix "$@"
+
       - type: file
         path: com.karmaa.termix.desktop
 

packaging/flatpak/termix.flatpakrepo

@@ -0,0 +1,7 @@
+[Flatpak Repo]
+Title=Termix
+Url=REPO_URL_PLACEHOLDER
+Homepage=https://github.com/Termix-SSH/Termix
+Comment=Self-hosted, plugin-based server management.
+Icon=https://raw.githubusercontent.com/Termix-SSH/Termix/main/public/icon.png
+GPGKey=GPG_KEY_PLACEHOLDER