native-packages 0.7.0 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66eea8a982e99cb22fd0f06318941567630bf486cd78a90be6f119fca9112185
-  data.tar.gz: 82acabb4632dd27e51088a8f2148a210cef3505d36f5ca46cee9a599bc5c96ed
+  metadata.gz: ef21c207476e3d19df85ebdb463eb0ccfb020ab8a4fd8ead551a22c4c2d4de62
+  data.tar.gz: 1648f4ffa1698dfdccea0d3693943e696b2810c69f595bf48fa01c386346808d
 SHA512:
-  metadata.gz: bdb0d4c085aa2029bfd5fab260a028660a3c63ed0c87841700cca32c41db291394aa71c7ea73b287d862a8f86eceaba02ee4259ac9b64d13c78c0fa144a7060d
-  data.tar.gz: b3700e1f354a72f46261a56817e01d186bb853a15dd5a98f01968adde00b464fc52f6a9b5b9f7cb7f1b089ad03a5096318eccd7d6d73323806b6637dcbafbe24
+  metadata.gz: f3cea3ca8d3d79956a0cca4ca779955b901795b1000a4ef57cad97abebfc32721d678df435ba8a46c2e226a210fdcb92f6c7cac586f81cc416ed5e8028ee300f
+  data.tar.gz: 2e6c2eaffc5cdab5cb3ef8ad3969b7058880cabb155f56170955f309d7b2e11701a384ac291f889cc5717d565b7073f1ec75edd51984b25554bad00e2564ec20

data/CONTRIBUTING.md

@@ -18,7 +18,7 @@ To check the packaged gem and standalone command:
 
 ```sh
 gem build native-packages.gemspec
-ruby test/gem_install.rb native-packages-0.7.0.gem
+ruby test/gem_install.rb native-packages-0.8.1.gem
 ```
 
 See [Releasing the gem](docs/releasing.md) for publication and

data/README.md

@@ -48,7 +48,7 @@ record. Local builds work without a GitHub release or credentials.
 
 | Platform | Outputs |
 | --- | --- |
-| Linux | DEB, RPM, Arch Linux packages, Alpine APK, IPK, and source RPM |
+| Linux | DEB, RPM, AppImage, Arch Linux packages, Alpine APK, IPK, and source RPM |
 | macOS | DMG, using your packaging script; optional Apple signing and notarization |
 | Windows | MSIX, or Inno Setup installers using your packaging script |
 

data/docs/_guides/building-packages.md

@@ -126,6 +126,10 @@ Both targets use the shared package metadata and file mappings. A target can
 have its own `nfpm` section to override them. Maps merge; lists replace the
 whole list, so a target-specific `contents` must list all of that target's files.
 
+Add `appimage` to a Linux target's formats for a single file that runs without
+installation. It needs one desktop entry and its icon among the contents; see
+[AppImage](../_reference/platforms.md#appimage).
+
 Use a separate musl or static build for Alpine. Changing `formats` alone
 does not change which systems a binary can run on.
 

data/docs/_guides/getting-started.md

@@ -17,7 +17,7 @@ own compiled executable, or build the tiny example below.
 You need Ruby 3.2 or later. Install the version used by these guides:
 
 ```sh
-gem install native-packages --version 0.7.0
+gem install native-packages --version 0.8.1
 ```
 
 For Linux packages, install **nFPM 2.47.0**, the helper native-packages uses to
@@ -79,7 +79,7 @@ Open the generated `native-packages.yaml` and replace its contents with:
 ```yaml
 schema: 1
 tool:
-  version: '0.7.0'
+  version: '0.8.1'
   nfpm: '2.47.0'
 
 nfpm:

data/docs/_guides/github-actions.md

@@ -24,7 +24,7 @@ packaging:
   needs: release
   permissions:
     contents: write
-  uses: crmne/native-packages/.github/workflows/package.yml@v0.7.0
+  uses: crmne/native-packages/.github/workflows/package.yml@v0.8.1
   with:
     version: ${{ github.ref_name }}
     publish: true
@@ -39,7 +39,7 @@ The configuration must include `release.repository` and a `release_asset`
 for each selected target. See [Publishing a release](publishing.md).
 
 Use the same native-packages release for the workflow and `tool.version`.
-For an immutable workflow reference, replace `v0.7.0` with that release's
+For an immutable workflow reference, replace `v0.8.1` with that release's
 full commit SHA.
 
 ## Build without publishing
@@ -57,7 +57,7 @@ permissions:
   contents: read
 jobs:
   packaging:
-    uses: crmne/native-packages/.github/workflows/package.yml@v0.7.0
+    uses: crmne/native-packages/.github/workflows/package.yml@v0.8.1
 ```
 
 Validation does not compile the app or check that future release inputs exist.
@@ -72,7 +72,7 @@ packaging:
   needs: build
   permissions:
     contents: write
-  uses: crmne/native-packages/.github/workflows/package.yml@v0.7.0
+  uses: crmne/native-packages/.github/workflows/package.yml@v0.8.1
   with:
     version: '1.2.3'
     source-artifact: linux-binaries
@@ -125,10 +125,14 @@ GitHub repository:
 | Destination | Repository variable | Secrets |
 | --- | --- | --- |
 | AUR group `aur` | `PUBLISH_AUR=true` | `AUR_SSH_KEY`, `AUR_KNOWN_HOSTS` |
-| Destination or group `homebrew` | `PUBLISH_HOMEBREW=true` | `HOMEBREW_TAP_GITHUB_TOKEN` |
-
-These steps run only with `publish: true`. The Homebrew token needs write
-access to your tap; the AUR key needs access to the configured repositories.
+| Destination or group `homebrew` | `PUBLISH_HOMEBREW=true` | `HOMEBREW_TAP_SSH_KEY` or `HOMEBREW_TAP_GITHUB_TOKEN` |
+
+These steps run only with `publish: true`. For Homebrew, prefer a deploy key
+with write access to the tap alone (`gh repo deploy-key add KEY.pub --repo
+OWNER/homebrew-tap --allow-write`) stored as `HOMEBREW_TAP_SSH_KEY`: GitHub URLs in that step then go over SSH,
+checked against GitHub's published host keys. A token
+in `HOMEBREW_TAP_GITHUB_TOKEN` also works and needs write access to the tap.
+The AUR key needs access to the configured repositories.
 Use `secrets: inherit` as in the release example, or pass the named secrets
 explicitly. If another tool already publishes a destination, keep one
 publisher responsible for it.

data/docs/_guides/native-recipes.md

@@ -31,7 +31,7 @@ Here is a complete configuration for an ARM64 Mac app and an x86-64 Windows app:
 ```yaml
 schema: 1
 tool:
-  version: '0.7.0'
+  version: '0.8.1'
   nfpm: '2.47.0'
 nfpm:
   name: hello

data/docs/_guides/prereleases.md

@@ -8,7 +8,7 @@ nav_order: 9
 
 Use a prerelease to let people test an upcoming version before the stable
 release. native-packages supports alpha, beta, and release candidate packages
-for **DEB, RPM, DMG, and Inno Setup**.
+for **DEB, RPM, AppImage, DMG, and Inno Setup**.
 
 ## Enable preview versions
 

data/docs/_guides/release-signing.md

@@ -67,7 +67,7 @@ Package publication's separate `packaging-checksums.txt` is also unchanged.
 
 ## Attest in the application's build job
 
-The examples use `v0.7.0` for readability. For release workflows, replace it
+The examples use `v0.8.1` for readability. For release workflows, replace it
 with that release's reviewed full commit SHA, not a mutable branch.
 After producing the final package, before uploading it, add this step to the
 job that built it:
@@ -79,7 +79,7 @@ permissions:
   attestations: write
 steps:
   # Existing checkout, build, platform signing and packaging steps go here.
-  - uses: crmne/native-packages/.github/actions/attest@v0.7.0
+  - uses: crmne/native-packages/.github/actions/attest@v0.8.1
     with:
       subject-path: dist/*.tar.gz
 ```
@@ -108,7 +108,7 @@ and install Ruby 3.2 or later with Ed25519-capable OpenSSL before the signing
 step. Then call:
 
 ```yaml
-- uses: crmne/native-packages/.github/actions/sign-release@v0.7.0
+- uses: crmne/native-packages/.github/actions/sign-release@v0.8.1
   with:
     directory: dist/release
     public-key: assets/update-public-key.hex

data/docs/_reference/commands.md

@@ -193,7 +193,7 @@ If several gem versions are installed, RubyGems lets you select the one required
 by the configuration:
 
 ```sh
-native-packages _0.7.0_ build --version 1.2.3
+native-packages _0.8.1_ build --version 1.2.3
 ```
 
 Bundler also works if you prefer to manage the gem in a Gemfile.

data/docs/_reference/configuration.md

@@ -28,7 +28,7 @@ expressions. Use the replacement values listed below.
 | Field | Purpose |
 | --- | --- |
 | `schema` | Required. Set to `1`. |
-| `tool.version` | Required. Exact native-packages version, such as `'0.7.0'`. |
+| `tool.version` | Required. Exact native-packages version, such as `'0.8.1'`. |
 | `tool.nfpm` | Required. Set to `'2.47.0'`, including in native-only configurations. |
 | `nfpm` | Shared package metadata and installed-file mappings, or a relative YAML filename. Requires `name`. |
 | `targets` | Required. Named build targets; use `{}` for recipe-only projects. |
@@ -97,8 +97,8 @@ letters, digits, and hyphens, starting with a letter or digit.
 | `after_package` | Command arguments run on each package before its hash is recorded. |
 | `native` | Required for DMG/Inno. Contains `command` and `output`. |
 
-Formats are `deb`, `rpm`, `archlinux`, `apk`, `ipk`, `srpm`, `msix`, `dmg`,
-and `inno`. See [Supported platforms](platforms.md) for their requirements.
+Formats are `deb`, `rpm`, `archlinux`, `apk`, `ipk`, `appimage`, `srpm`,
+`msix`, `dmg`, and `inno`. See [Supported platforms](platforms.md) for their requirements.
 
 Windows targets select only `[msix]` or `[inno]`; macOS targets select `[dmg]`.
 DMG and Inno each require a separate binary target. SRPM requires a separate

data/docs/_reference/platforms.md

@@ -19,6 +19,7 @@ libraries.
 | `archlinux` | Linux | Arch-compatible files and explicit dependencies. | nFPM, `readelf` for binaries. |
 | `apk` | Linux | Suitable Alpine files, usually musl or static binaries, and dependencies. | nFPM, `readelf` for binaries. |
 | `ipk` | Linux | Files for the device/distribution baseline, dependencies, and an `abi` label. | nFPM, `readelf` for binaries. |
+| `appimage` | Linux | The same files as the DEB/RPM, including one desktop entry and its icon. | `mksquashfs` (squashfs-tools), `curl`, `readelf`. |
 | `srpm` | Linux source target | RPM spec and source files. | nFPM; native RPM tooling for rebuild tests. |
 | `msix` | Windows | Windows binaries, identity, application assets, and capabilities. | nFPM; Windows tools for signing and installation tests. |
 | `dmg` | macOS | Complete app and a DMG script. | macOS, `lipo`, and your script's tools, such as `hdiutil`. |
@@ -48,6 +49,45 @@ For IPK, check which format your device's distribution release actually uses.
 The repository's IPK fixture targets OpenWrt 24.10.8; its coverage should not
 be treated as a claim about every OpenWrt version.
 
+## AppImage
+
+An AppImage is one executable file that runs without installation. Add
+`appimage` to a Linux binary target's `formats`; it uses the same `contents`
+as the other formats, so there is nothing else to describe:
+
+```yaml
+linux-amd64:
+  platform: linux
+  arch: amd64
+  libc: glibc
+  formats: [deb, rpm, appimage]
+```
+
+The package must install exactly one desktop entry under
+`/usr/share/applications`. Its `Exec` names the program the AppImage runs
+(found in `/usr/bin`, or an absolute path inside the package) and its `Icon`
+names an SVG or PNG under `/usr/share/icons` or `/usr/share/pixmaps`. A
+contents entry with `packager: appimage` is included only in the AppImage, and
+one with another packager is left out. Entries of type `ghost` are skipped.
+
+The output is `NAME-VERSION-ARCH.AppImage`, with AppImage's architecture names
+(`x86_64`, `aarch64`, `i686`, `armhf` for `amd64`, `arm64`, `386`, `arm7`).
+The file is the pinned AppImage runtime (type2-runtime 20251108, downloaded
+once into `.cache/native-packages` and checked against a built-in SHA-256)
+followed by a zstd SquashFS image. No `appimagetool` or nFPM is involved, the
+build does not run the binary, and an ARM64 AppImage can be built on an x86
+host. The same inputs and `SOURCE_DATE_EPOCH` give the same bytes.
+
+**Libraries are not bundled.** The AppImage uses the host's libraries, as the
+DEB and RPM do, and `build.json` lists what the binary links under
+`required_libraries` with `"libraries": "host"`. It therefore runs where your
+binary's glibc floor and those libraries are met, not on every Linux system.
+Build on the oldest distribution you support, or link statically, to widen
+that. The AppImage carries no update information and is not signed.
+
+Running an AppImage needs FUSE on the user's system, or
+`./App.AppImage --appimage-extract-and-run`.
+
 ## MSIX
 
 MSIX targets use `platform: windows`, `formats: [msix]`, and PE binaries with
@@ -87,7 +127,7 @@ An Arch package file and an AUR recipe are separate outputs: the former can
 be installed directly; the latter tells Arch tooling how to obtain and package
 your app.
 
-There is no Flatpak build/publication adapter, no NSIS/WiX adapter, and no
+There is no Flatpak or Snap build/publication adapter, no NSIS/WiX adapter, and no
 hosted APT/DNF index service. Keep those workflows in your app's release
 process if you need them.
 

data/docs/_reference/troubleshooting.md

@@ -23,8 +23,8 @@ working on with `doctor --target ID` and `build --target ID --dry-run`.
 Install and select the version named in the error:
 
 ```sh
-gem install native-packages --version 0.7.0
-native-packages _0.7.0_ doctor
+gem install native-packages --version 0.8.1
+native-packages _0.8.1_ doctor
 ```
 
 `tool.version` is an exact match. In CI, use the matching released reusable

data/docs/index.md

@@ -25,7 +25,7 @@ features:
     details: Describe your app's files, package metadata, and build targets in a single YAML file.
   - icon: 🐧
     title: Linux packages
-    details: Create DEB, RPM, Arch, Alpine, and IPK packages from your compatible Linux builds.
+    details: Create DEB, RPM, AppImage, Arch, Alpine, and IPK packages from your compatible Linux builds.
   - icon: 🖥️
     title: Native installers
     details: Connect your macOS DMG and Windows Inno Setup scripts, or package Windows apps as MSIX.

data/docs/releasing.md

@@ -23,7 +23,7 @@ Update the gemspec, `NativePackages::VERSION`, example/version references and ch
 Create a GitHub release for that commit:
 
 ```sh
-gh release create v0.7.0 --target main --title 'native-packages 0.7.0' --notes-file release-notes.md
+gh release create v0.8.1 --target main --title 'native-packages 0.8.1' --notes-file release-notes.md
 ```
 
 Adding `--draft` permits review before publication and does not trigger the publisher. The tag must match the exact gem version and point to a commit on `main`. Set `--prerelease` only for a prerelease gem version.
@@ -31,3 +31,16 @@ Adding `--draft` permits review before publication and does not trigger the publ
 The release workflow verifies the tag, tested commit and prerelease setting, then runs the test workflow, including native package acceptance. It downloads the tested gem from the Ruby 4.0 job, publishes it to RubyGems and GitHub Packages, and attaches it to the GitHub release. It does not rebuild a different artifact after the tests.
 
 If authentication is missing, leave the tested gem and release draft available until the secret is configured. Failed release jobs can be rerun after configuration; already-published gem versions are not overwritten. Never move an existing release tag to retry publication.
+
+If the workflow itself needs a correction, fix it on `main` and dispatch the
+corrected release workflow against the existing published tag:
+
+```sh
+gh workflow run release.yml --ref main -f tag=v0.8.1
+```
+
+Validation resolves the original tag to an exact commit, requires it to be on
+`main`, and checks the existing release's version and prerelease state. Every
+test and publication checkout uses that commit, not the newer workflow commit.
+The gem is taken from that retry's tested Ruby 4.0 artifact. This permits a
+workflow repair without moving a tag or publishing untested source.

data/examples/native-packages-all-formats.yaml

@@ -1,7 +1,7 @@
 # Supply the listed build outputs before running this example.
 schema: 1
 tool:
-  version: '0.7.0'
+  version: '0.8.1'
   nfpm: '2.47.0'
 nfpm:
   name: example-app

data/examples/native-packages.yaml

@@ -1,6 +1,6 @@
 schema: 1
 tool:
-  version: '0.7.0'
+  version: '0.8.1'
   nfpm: '2.47.0'
 nfpm:
   name: example-app

data/lib/native_packages/appimage.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+module NativePackages
+  # Builds a type 2 AppImage from the same contents nFPM packages: the files
+  # are laid out in an AppDir, packed with mksquashfs and appended to a pinned
+  # AppImage runtime. Libraries are not bundled; the AppImage uses the host's,
+  # as the deb and rpm packages do.
+  class AppImage
+    include Support
+    RUNTIME = "20251108"
+    RUNTIME_URL = "https://github.com/AppImage/type2-runtime/releases/download/#{RUNTIME}"
+    # nFPM architecture => [AppImage architecture, runtime SHA-256].
+    RUNTIMES = {
+      "amd64" => ["x86_64", "2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d"],
+      "arm64" => ["aarch64", "00cbdfcf917cc6c0ff6d3347d59e0ca1f7f45a6df1a428a0d6d8a78664d87444"],
+      "386" => ["i686", "e72ea0b140a0a16e680713238a6f30aad278b62c4ca17919c554864124515498"],
+      "arm7" => ["armhf", "e9060d37577b8a29914ec12d8740add24e19ff29012fb1fa0f60daf62db0688d"]
+    }.freeze
+    ICON_DIRECTORIES = %w[usr/share/icons usr/share/pixmaps].freeze
+    attr_reader :root
+
+    def initialize(root)
+      @root = root
+    end
+
+    def self.architecture(target)
+      RUNTIMES.fetch(target.fetch("arch")) { raise Error, "appimage does not support #{target.fetch('arch')}; use #{RUNTIMES.keys.join(', ')}" }.first
+    end
+
+    def self.filename(name, version, target) = "#{name}-#{version}-#{architecture(target)}.AppImage"
+
+    def doctor(target)
+      self.class.architecture(target)
+      missing = %w[mksquashfs curl].reject { |tool| available?(tool) }
+      raise Error, "install required AppImage tools: #{missing.join(', ')} (mksquashfs is in squashfs-tools)" unless missing.empty?
+    end
+
+    def runtime(target)
+      architecture, digest = RUNTIMES.fetch(target.fetch("arch"))
+      path = root / ".cache/native-packages/appimage-runtime" / RUNTIME / "runtime-#{architecture}"
+      download("#{RUNTIME_URL}/runtime-#{architecture}", path)
+      unless sha256(path) == digest
+        path.delete
+        raise Error, "AppImage runtime checksum mismatch: runtime-#{architecture}"
+      end
+      path
+    end
+
+    # Returns the AppImage's path and what was put at the AppDir's root.
+    def build(package, target, destination, name:, version:, epoch:)
+      doctor(target)
+      output = destination / self.class.filename(name, version, target)
+      Dir.mktmpdir("native-packages-appimage-") do |directory|
+        appdir = Pathname.new(directory) / "AppDir"
+        appdir.mkpath
+        stage(package, appdir)
+        entry = integrate(appdir)
+        normalize(appdir, epoch)
+        image = Pathname.new(directory) / "filesystem.squashfs"
+        run "mksquashfs", appdir, image, "-root-owned", "-noappend", "-no-xattrs", "-no-progress", "-quiet", "-comp", "zstd",
+          env: { "SOURCE_DATE_EPOCH" => epoch.to_s }
+        File.open(output, "wb") do |file|
+          file.write(runtime(target).binread)
+          IO.copy_stream(image.to_s, file)
+        end
+        output.chmod(0o755)
+        check(output)
+        [output, entry.merge("runtime" => RUNTIME, "libraries" => "host")]
+      end
+    end
+
+    def check(path)
+      header = path.binread(11)
+      raise Error, "not a type 2 AppImage: #{path}" unless header&.start_with?("\x7fELF".b) && header.byteslice(8, 3) == "AI\x02".b
+    end
+
+    # nFPM overrides replace the contents list when one is supplied.
+    def contents(package)
+      package.fetch("overrides", {}).fetch("appimage", {}).fetch("contents", package.fetch("contents"))
+        .reject { |item| item["packager"] && item["packager"] != "appimage" }
+    end
+
+    def inside(appdir, destination)
+      raise Error, "appimage: content destinations must be absolute: #{destination}" unless destination.to_s.start_with?("/")
+      appdir / relative_path(destination.to_s.delete_prefix("/"))
+    end
+
+    def stage(package, appdir)
+      contents(package).each do |item|
+        type = item.fetch("type", "file")
+        next if type == "ghost"
+        target = inside(appdir, item.fetch("dst"))
+        mode = item.dig("file_info", "mode")
+        case type
+        when "dir"
+          target.mkpath
+        when "symlink"
+          target.dirname.mkpath
+          File.symlink(item.fetch("src"), target)
+        when "file", "tree", "config", "config|noreplace", "config|missingok"
+          source = File.expand_path(item.fetch("src"), root)
+          paths = package["disable_globbing"] ? [source].select { |path| File.exist?(path) } : Dir.glob(source).sort
+          raise Error, "missing package content: #{source}" if paths.empty?
+          # As nFPM does: a glob source, or a destination ending in a slash,
+          # makes the destination a directory that takes each match's name.
+          pattern = !package["disable_globbing"] && item.fetch("src").match?(/[*?\[{]/)
+          single = paths.length == 1 && File.file?(paths.first) && type != "tree" && !pattern && !item.fetch("dst").end_with?("/")
+          paths.each do |path|
+            if File.directory?(path)
+              target.mkpath
+              FileUtils.cp_r(Dir.children(path).map { |child| File.join(path, child) }, target)
+            else
+              file = single ? target : target / File.basename(path)
+              file.dirname.mkpath
+              FileUtils.cp(path, file)
+              file.chmod(mode) if mode
+            end
+          end
+        else
+          raise Error, "appimage: unsupported content type #{type}"
+        end
+      end
+    end
+
+    # AppImage's root needs the desktop entry, its icon and AppRun.
+    def integrate(appdir)
+      entries = Pathname.glob(appdir / "usr/share/applications/*.desktop")
+      raise Error, "appimage needs exactly one desktop entry in /usr/share/applications; found #{entries.length}" unless entries.length == 1
+      desktop = entries.first
+      fields = desktop.read.lines.each_with_object({}) do |line, result|
+        key, value = line.strip.split("=", 2)
+        result[key] ||= value if value && %w[Exec Icon].include?(key)
+      end
+      command = Shellwords.split(fields.fetch("Exec") { raise Error, "appimage: #{desktop.basename} has no Exec" }).first
+      executable = command.start_with?("/") ? inside(appdir, command) : appdir / "usr/bin" / relative_path(command)
+      raise Error, "appimage: #{desktop.basename} runs #{command}, which the package does not install" unless executable.file? && executable.executable?
+      name = fields.fetch("Icon") { raise Error, "appimage: #{desktop.basename} has no Icon" }
+      raise Error, "appimage: Icon must be a name, not a path" if name.include?("/")
+      icons = ICON_DIRECTORIES.flat_map { |path| Pathname.glob(appdir / path / "**" / "#{name}.{svg,png}") }
+      # A scalable icon first, else the largest bitmap.
+      icon = icons.find { |path| path.extname == ".svg" } || icons.max_by(&:size)
+      raise Error, "appimage: the package installs no #{name}.svg or #{name}.png icon" unless icon
+      FileUtils.cp(desktop, appdir / desktop.basename)
+      FileUtils.cp(icon, appdir / icon.basename)
+      File.symlink(icon.basename.to_s, appdir / ".DirIcon")
+      File.symlink(executable.relative_path_from(appdir).to_s, appdir / "AppRun")
+      { "desktop" => desktop.basename.to_s, "icon" => icon.basename.to_s, "executable" => executable.relative_path_from(appdir).to_s }
+    end
+
+    # The same bytes for the same inputs: fixed modes and times.
+    def normalize(appdir, epoch)
+      time = Time.at(epoch)
+      Pathname.glob(appdir / "**/*", File::FNM_DOTMATCH).each do |path|
+        next if path.basename.to_s == "."
+        if path.symlink?
+          File.lutime(time, time, path)
+        else
+          path.chmod(path.directory? || path.executable? ? 0o755 : 0o644)
+          File.utime(time, time, path)
+        end
+      end
+      appdir.chmod(0o755)
+      File.utime(time, time, appdir)
+    end
+  end
+end

data/lib/native_packages/build.rb

@@ -4,6 +4,7 @@ require_relative "configuration"
 require_relative "inspection"
 require_relative "native_recipe"
 require_relative "macos_signing"
+require_relative "appimage"
 
 module NativePackages
   class Build
@@ -31,7 +32,8 @@ module NativePackages
     def doctor(ids: [], formats: [], release: false, defer_recipes: false)
       configuration.validate
       selected = configuration.select(ids: ids, formats: formats)
-      nfpm_version if selected.values.any? { |target| (target.fetch("formats") & Configuration::NATIVE_FORMATS).empty? }
+      nfpm_version if selected.values.any? { |target| !(target.fetch("formats") - Configuration::NATIVE_FORMATS - ["appimage"]).empty? }
+      selected.each_value { |target| AppImage.new(root).doctor(target) if target.fetch("formats").include?("appimage") }
       selected.each do |id, target|
         next unless target["native"]
         metadata = configuration.target_tokens(configuration.tokens("9.8.7"), id, target, "/payload").merge("PACKAGE" => "/output/package", "FORMAT" => target.fetch("formats").first)
@@ -155,6 +157,14 @@ module NativePackages
                   packages = files(destination)
                   raise Error, "native recipe must create only its declared output" unless packages == [package_path]
                   native.check_output(package_path, format)
+                elsif format == "appimage"
+                  package = render_tree(configuration.package(target), configuration.target_tokens(info, id, target, payload))
+                  inspection = Inspection.new(root, configuration.data.fetch("libraries")).check(package, target, format)
+                  package_path, details = AppImage.new(root).build(package, target, destination, name: configuration.name, version: number,
+                    epoch: info.fetch("SOURCE_DATE_EPOCH"))
+                  inspection["appimage"] = details
+                  packages = files(destination)
+                  raise Error, "AppImage build must create only its package" unless packages == [package_path]
                 else
                   package = render_tree(configuration.package(target), configuration.target_tokens(info, id, target, payload))
                   if number.include?("-") && (package.fetch("version_schema", "semver") != "semver" || %w[prerelease version_metadata].any? { |key| package.key?(key) && !package[key].to_s.empty? })
@@ -174,6 +184,7 @@ module NativePackages
                   hook_tokens = configuration.target_tokens(info, id, target, payload).merge("PACKAGE" => packages.first.to_s, "FORMAT" => format)
                   run(*render_tree(target.fetch("after_package"), hook_tokens), env: { "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number })
                   raise Error, "after_package must preserve the package path and output set" unless files(destination) == packages
+                  AppImage.new(root).check(packages.first) if format == "appimage"
                 end
                 if native
                   native.check_output(packages.first, format)

data/lib/native_packages/configuration.rb

@@ -1,12 +1,13 @@
 # frozen_string_literal: true
 
 require_relative "project"
+require_relative "appimage"
 
 module NativePackages
   class Configuration
     include Support
     NATIVE_FORMATS = %w[dmg inno].freeze
-    FORMATS = (%w[deb rpm archlinux apk ipk msix srpm] + NATIVE_FORMATS).freeze
+    FORMATS = (%w[deb rpm archlinux apk ipk msix srpm appimage] + NATIVE_FORMATS).freeze
     NFPM_VERSION = "2.47.0"
     NAMES = %w[native-packages.yaml native-packages.yml].freeze
     KEYS = %w[schema tool nfpm targets release assets templates repositories revisions libraries version_file version_section].freeze
@@ -59,8 +60,8 @@ module NativePackages
     def check_prerelease(version, selected, defer_recipes: false)
       return unless version.include?("-")
       raise Error, "prerelease builds require release.prereleases: true" unless data.fetch("release")["prereleases"] == true
-      unless selected.values.all? { |target| (target.fetch("formats") - %w[deb rpm dmg inno]).empty? } && (defer_recipes || data.fetch("templates").empty?)
-        raise Error, "prereleases support deb, rpm, dmg and inno only, without downstream recipes"
+      unless selected.values.all? { |target| (target.fetch("formats") - %w[deb rpm appimage dmg inno]).empty? } && (defer_recipes || data.fetch("templates").empty?)
+        raise Error, "prereleases support deb, rpm, appimage, dmg and inno only, without downstream recipes"
       end
     end
 
@@ -121,6 +122,10 @@ module NativePackages
         if kind == "binary" && target["platform"] == "linux"
           raise Error, "#{id}.libc: declare glibc, musl or static" unless %w[glibc musl static].include?(target["libc"])
         end
+        if formats.include?("appimage")
+          raise Error, "#{id}: AppImage requires a Linux binary target" unless target["platform"] == "linux" && kind == "binary"
+          AppImage.architecture(target)
+        end
         raise Error, "#{id}: IPK needs an explicit abi (device/distribution baseline)" if formats.include?("ipk") && target.fetch("abi", "").empty?
         input = mapping(target.fetch("input"), "#{id}.input")
         raise Error, "#{id}.input: declare local or release_asset" unless input["local"] || input["release_asset"]

data/lib/native_packages/inspection.rb

@@ -115,6 +115,8 @@ module NativePackages
           depends << (format == "deb" ? "libc6 (>= #{floor})" : "glibc >= #{floor}")
         end
         override["depends"] = depends.uniq
+      elsif format == "appimage"
+        # Nothing is bundled: the host supplies these, as for deb and rpm.
       elsif !external.empty? && package.fetch("overrides", {}).fetch(format, {}).fetch("depends", package.fetch("depends", [])).empty?
         raise Error, "#{format}: declare dependencies for #{external.join(', ')}"
       end

data/lib/native_packages/support.rb

@@ -12,7 +12,7 @@ require "tmpdir"
 require "yaml"
 
 module NativePackages
-  VERSION = "0.7.0"
+  VERSION = "0.8.1"
   class Error < StandardError; end
 
   module Support

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: native-packages
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.8.1
 platform: ruby
 authors:
 - Carmine Paolino
@@ -52,6 +52,7 @@ files:
 - examples/packaging/repositories.yml
 - exe/native-packages
 - lib/native_packages.rb
+- lib/native_packages/appimage.rb
 - lib/native_packages/build.rb
 - lib/native_packages/cli.rb
 - lib/native_packages/configuration.rb