pakstr 0.30.0 → 1.0.0

package/android-template/app/src/test/java/com/pakstr/app/WebMessageRouterTest.kt

@@ -0,0 +1,279 @@
+package com.pakstr.app
+
+import com.pakstr.app.signer.NostrBridge
+import com.pakstr.app.signer.exceptions.SignerUnavailableException
+import com.pakstr.app.signer.interfaces.NostrSigner
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class WebMessageRouterTest {
+    private val trusted = MessageSource("http", "127.0.0.1", Config.PORT, null, null, isMainFrame = true)
+
+    @Test
+    fun requestFromTheAppTopFrameIsAnsweredToTheSender() {
+        val bridge = Harness()
+
+        val replies = bridge.send(trusted, request("id-1", "nostr.getPublicKey"))
+
+        assertEquals(1, replies.size)
+        val reply = JSONObject(replies.single())
+        assertEquals(1, reply.getInt("v"))
+        assertEquals("id-1", reply.getString("id"))
+        assertTrue(reply.getBoolean("ok"))
+        assertEquals(PUBKEY, reply.getString("result"))
+        assertEquals(listOf("getPublicKey"), bridge.signer.calls)
+    }
+
+    @Test
+    fun subframesAreRejectedWithoutReachingTheSigner() {
+        val bridge = Harness()
+
+        val replies = bridge.send(trusted.copy(isMainFrame = false), request("id-1", "nostr.signEvent", EVENT))
+
+        assertTrue(replies.isEmpty())
+        assertTrue(bridge.signer.calls.isEmpty())
+        assertEquals(0, bridge.handled)
+    }
+
+    @Test
+    fun untrustedOriginsAreRejectedWithoutReachingAnyHandler() {
+        val untrusted = listOf(
+            trusted.copy(scheme = "https"),
+            trusted.copy(port = Config.PORT + 1),
+            trusted.copy(host = "localhost"),
+            trusted.copy(host = "evil.example"),
+            trusted.copy(userInfo = "user"),
+            trusted.copy(path = "/index.html"),
+            MessageSource(null, null, -1, null, null, isMainFrame = true)
+        )
+        for (source in untrusted) {
+            val bridge = Harness()
+            for (method in listOf("nostr.nip44_decrypt", "runtime.setApiBaseUrl", "runtime.getApiBaseUrl")) {
+                val replies = bridge.send(
+                    source,
+                    request("id-1", method, JSONObject().put("url", "https://evil.example"))
+                )
+                assertTrue("$source $method", replies.isEmpty())
+            }
+            assertEquals(source.toString(), 0, bridge.handled)
+            assertNull(bridge.preferences.values[RuntimeApiBaseSettings.API_BASE_OVERRIDE_KEY])
+        }
+    }
+
+    @Test
+    fun nonStringOversizedAndMalformedMessagesAreDropped() {
+        val bridge = Harness()
+        val oversized = request(
+            "id-1",
+            "nostr.nip44_encrypt",
+            JSONObject().put("pubkey", PUBKEY).put("plaintext", "x".repeat(WebMessageRouter.MAX_MESSAGE_BYTES))
+        )
+        val dropped = listOf(
+            null,
+            oversized,
+            "",
+            "not json",
+            "[1,2,3]",
+            JSONObject().put("id", "id-1").put("method", "nostr.getPublicKey").toString(),
+            request("id-1", "nostr.getPublicKey").replace("\"v\":1", "\"v\":2"),
+            request("id-1", "nostr.getPublicKey").replace("\"v\":1", "\"v\":\"1\""),
+            JSONObject().put("v", 1).put("method", "nostr.getPublicKey").toString(),
+            request("bad id", "nostr.getPublicKey"),
+            request("x".repeat(65), "nostr.getPublicKey"),
+            JSONObject().put("v", 1).put("id", 7).put("method", "nostr.getPublicKey").toString()
+        )
+        for (message in dropped) {
+            assertTrue(message?.take(80).toString(), bridge.send(trusted, message).isEmpty())
+        }
+        assertEquals(0, bridge.handled)
+    }
+
+    @Test
+    fun multiByteMessagesAreMeasuredInUtf8Bytes() {
+        val bridge = Harness()
+        // Under the limit in UTF-16 characters, over it in UTF-8 bytes.
+        val plaintext = "é".repeat(WebMessageRouter.MAX_MESSAGE_BYTES / 2)
+        val message = request("id-1", "nostr.nip44_encrypt", JSONObject().put("pubkey", PUBKEY).put("plaintext", plaintext))
+
+        assertTrue(message.length <= WebMessageRouter.MAX_MESSAGE_BYTES)
+        assertTrue(bridge.send(trusted, message).isEmpty())
+    }
+
+    @Test
+    fun invalidRequestsWithAValidIdGetAnErrorReply() {
+        val bridge = Harness()
+        val noMethod = JSONObject().put("v", 1).put("id", "id-1").toString()
+        val arrayParams = JSONObject().put("v", 1).put("id", "id-2").put("method", "nostr.signEvent")
+            .put("params", org.json.JSONArray().put(1)).toString()
+
+        for ((message, id) in listOf(noMethod to "id-1", arrayParams to "id-2")) {
+            val reply = JSONObject(bridge.send(trusted, message).single())
+            assertEquals(id, reply.getString("id"))
+            assertFalse(reply.getBoolean("ok"))
+            assertEquals("SIGNER_ERROR", reply.getJSONObject("error").getString("error"))
+            assertEquals("Invalid request", reply.getJSONObject("error").getString("message"))
+        }
+        assertEquals(0, bridge.handled)
+    }
+
+    @Test
+    fun unknownMethodsAreRejected() {
+        val bridge = Harness()
+        for (method in listOf("nostr.unknown", "nostr.", "runtime.reset", "AndroidBridge.call", "debug.unknown")) {
+            val reply = JSONObject(bridge.send(trusted, request("id-1", method)).single())
+            assertFalse(method, reply.getBoolean("ok"))
+            assertEquals("SIGNER_ERROR", reply.getJSONObject("error").getString("error"))
+            assertEquals("Unsupported method", reply.getJSONObject("error").getString("message"))
+        }
+        assertTrue(bridge.signer.calls.isEmpty())
+    }
+
+    @Test
+    fun signerFailuresKeepTheirErrorCodes() {
+        val unavailable = Harness(FakeSigner(failure = SignerUnavailableException("No signer is paired")))
+        val unavailableReply = JSONObject(unavailable.send(trusted, request("id-1", "nostr.getPublicKey")).single())
+        assertEquals("SIGNER_UNAVAILABLE", unavailableReply.getJSONObject("error").getString("error"))
+        assertEquals("No signer is paired", unavailableReply.getJSONObject("error").getString("message"))
+
+        val failing = Harness(FakeSigner(failure = IllegalStateException("rejected")))
+        val failingReply = JSONObject(failing.send(trusted, request("id-1", "nostr.signEvent", EVENT)).single())
+        assertFalse(failingReply.getBoolean("ok"))
+        assertEquals("SIGNER_ERROR", failingReply.getJSONObject("error").getString("error"))
+        assertEquals("rejected", failingReply.getJSONObject("error").getString("message"))
+    }
+
+    @Test
+    fun plaintextThatLooksLikeAnErrorObjectIsStillAResult() {
+        val plaintext = """{"error":"x","message":"y"}"""
+        val bridge = Harness(FakeSigner(decrypted = plaintext))
+
+        val reply = JSONObject(
+            bridge.send(
+                trusted,
+                request("id-1", "nostr.nip44_decrypt", JSONObject().put("pubkey", PUBKEY).put("ciphertext", "c"))
+            ).single()
+        )
+
+        assertTrue(reply.getBoolean("ok"))
+        assertEquals(plaintext, reply.getString("result"))
+    }
+
+    @Test
+    fun runtimeMethodsUseTheRuntimeApiBaseSettings() {
+        val bridge = Harness()
+
+        val set = JSONObject(
+            bridge.send(trusted, request("id-1", "runtime.setApiBaseUrl", JSONObject().put("url", "https://api.example.com/"))).single()
+        )
+        assertTrue(set.getBoolean("result"))
+        val get = JSONObject(bridge.send(trusted, request("id-2", "runtime.getApiBaseUrl")).single())
+        assertEquals("https://api.example.com", get.getString("result"))
+
+        for (params in listOf(JSONObject().put("url", "http://insecure.example.com"), JSONObject().put("url", 5), null)) {
+            val rejected = JSONObject(bridge.send(trusted, request("id-3", "runtime.setApiBaseUrl", params)).single())
+            assertTrue(rejected.getBoolean("ok"))
+            assertFalse(rejected.getBoolean("result"))
+        }
+        assertEquals("https://api.example.com", bridge.preferences.values[RuntimeApiBaseSettings.API_BASE_OVERRIDE_KEY])
+
+        val callback = JSONObject(bridge.send(trusted, request("id-4", "runtime.getNip55CallbackUrl")).single())
+        assertEquals(Nip55Callback.callbackPrefix, callback.getString("result"))
+    }
+
+    @Test
+    fun debugLogIsANotificationWithoutAReply() {
+        val bridge = Harness()
+        val message = JSONObject().put("v", 1).put("method", WebMessageRouter.DEBUG_LOG_METHOD)
+            .put("params", JSONObject().put("level", "WARN").put("message", "hello")).toString()
+
+        assertTrue(bridge.send(trusted, message).isEmpty())
+        assertEquals(listOf("WARN" to "hello"), bridge.debugLogs)
+
+        assertTrue(bridge.send(trusted.copy(isMainFrame = false), message).isEmpty())
+        assertEquals(1, bridge.debugLogs.size)
+    }
+
+    @Test
+    fun repliesArePostedThroughTheMainThreadHook() {
+        var posted = 0
+        val bridge = Harness(runOnMain = { block -> posted++; block() })
+
+        bridge.send(trusted, request("id-1", "nostr.getPublicKey"))
+        bridge.send(trusted, JSONObject().put("v", 1).put("id", "id-2").toString())
+
+        assertEquals(2, posted)
+    }
+
+    private fun request(id: String, method: String, params: JSONObject? = null): String =
+        JSONObject().put("v", 1).put("id", id).put("method", method)
+            .apply { if (params != null) put("params", params) }
+            .toString()
+
+    private class Harness(
+        val signer: FakeSigner = FakeSigner(),
+        runOnMain: (() -> Unit) -> Unit = { block -> block() }
+    ) {
+        val preferences = FakePreferences()
+        val debugLogs = mutableListOf<Pair<String, String>>()
+        var handled = 0
+        private val methods = PakstrBridgeMethods(
+            nostr = NostrBridge(signerProvider = { signer }),
+            runtime = PakstrBridge(RuntimeApiBaseSettings.createForTesting(preferences) { null }),
+            debugLog = { level, message -> debugLogs += level to message }
+        )
+        private val router = WebMessageRouter(
+            handler = { method, params -> handled++; methods.handle(method, params) },
+            scope = CoroutineScope(Dispatchers.Unconfined),
+            runOnMain = runOnMain
+        )
+
+        fun send(source: MessageSource, data: String?): List<String> {
+            val replies = mutableListOf<String>()
+            router.onMessage(source, data) { replies += it }
+            return replies
+        }
+    }
+
+    private class FakeSigner(
+        private val failure: Exception? = null,
+        private val decrypted: String = "plaintext"
+    ) : NostrSigner {
+        val calls = mutableListOf<String>()
+
+        private fun record(name: String) {
+            calls += name
+            failure?.let { throw it }
+        }
+
+        override suspend fun getPublicKey(): String = PUBKEY.also { record("getPublicKey") }
+        override suspend fun signEvent(eventJson: String): String = eventJson.also { record("signEvent") }
+        override suspend fun nip04Encrypt(pubkey: String, plaintext: String) = "c04".also { record("nip04Encrypt") }
+        override suspend fun nip04Decrypt(pubkey: String, ciphertext: String) = decrypted.also { record("nip04Decrypt") }
+        override suspend fun nip44Encrypt(pubkey: String, plaintext: String) = "c44".also { record("nip44Encrypt") }
+        override suspend fun nip44Decrypt(pubkey: String, ciphertext: String) = decrypted.also { record("nip44Decrypt") }
+    }
+
+    private class FakePreferences : RuntimeApiBaseSettings.Preferences {
+        val values = mutableMapOf<String, String>()
+        override fun getString(key: String): String? = values[key]
+        override fun putString(key: String, value: String): Boolean {
+            values[key] = value
+            return true
+        }
+        override fun remove(key: String): Boolean {
+            values.remove(key)
+            return true
+        }
+    }
+
+    private companion object {
+        val PUBKEY = "a".repeat(64)
+        val EVENT: JSONObject = JSONObject().put("kind", 1).put("created_at", 1).put("tags", org.json.JSONArray()).put("content", "hi")
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/signer/NostrBridgeDispatchTest.kt

@@ -0,0 +1,113 @@
+package com.pakstr.app.signer
+
+import com.pakstr.app.signer.interfaces.NostrSigner
+import kotlinx.coroutines.runBlocking
+import org.json.JSONArray
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertThrows
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class NostrBridgeDispatchTest {
+    private val pubkey = "b".repeat(64)
+
+    @Test
+    fun each_method_reaches_the_matching_signer_call_with_its_arguments() {
+        val signer = RecordingSigner()
+        val bridge = NostrBridge(signerProvider = { signer })
+        val event = JSONObject()
+            .put("kind", 1)
+            .put("created_at", 1_700_000_000)
+            .put("tags", JSONArray().put(JSONArray().put("t").put("x")))
+            .put("content", "hi")
+
+        runBlocking {
+            assertEquals("pk", bridge.handle("getPublicKey", null))
+            assertEquals("signed", bridge.handle("signEvent", event))
+            assertEquals("c04", bridge.handle("nip04_encrypt", JSONObject().put("pubkey", pubkey).put("plaintext", "p")))
+            assertEquals("p04", bridge.handle("nip04_decrypt", JSONObject().put("pubkey", pubkey).put("ciphertext", "c")))
+            assertEquals("c44", bridge.handle("nip44_encrypt", JSONObject().put("pubkey", pubkey).put("plaintext", "p")))
+            assertEquals("p44", bridge.handle("nip44_decrypt", JSONObject().put("pubkey", pubkey).put("ciphertext", "c")))
+        }
+
+        assertEquals(
+            listOf(
+                listOf("getPublicKey"),
+                listOf("signEvent", event.toString()),
+                listOf("nip04Encrypt", pubkey, "p"),
+                listOf("nip04Decrypt", pubkey, "c"),
+                listOf("nip44Encrypt", pubkey, "p"),
+                listOf("nip44Decrypt", pubkey, "c")
+            ),
+            signer.calls
+        )
+        assertEquals(event.toString(), JSONObject(signer.calls[1][1]).toString())
+    }
+
+    @Test
+    fun invalid_arguments_fail_before_the_signer_is_requested() {
+        var requested = 0
+        val bridge = NostrBridge(signerProvider = { requested++; RecordingSigner() })
+
+        val cases = listOf(
+            Triple("signEvent", null, "Event payload is empty"),
+            Triple("nip04_encrypt", null, "NIP04 encrypt payload is empty"),
+            Triple("nip04_decrypt", null, "NIP04 decrypt payload is empty"),
+            Triple("nip04_encrypt", JSONObject().put("pubkey", pubkey), null),
+            Triple("nip44_encrypt", null, null),
+            Triple("nip44_decrypt", JSONObject().put("ciphertext", "c"), null)
+        )
+        for ((method, params, message) in cases) {
+            val error = assertThrows(Exception::class.java) {
+                runBlocking { bridge.handle(method, params) }
+            }
+            if (message != null) assertEquals(method, message, error.message)
+        }
+        assertEquals(0, requested)
+    }
+
+    @Test
+    fun unsupported_methods_are_rejected_without_a_signer() {
+        var requested = 0
+        val bridge = NostrBridge(signerProvider = { requested++; RecordingSigner() })
+
+        for (method in listOf("", "call", "debugLog", "getPublicKey ", "nip04Encrypt", "__proto__")) {
+            val error = assertThrows(UnsupportedBridgeMethodException::class.java) {
+                runBlocking { bridge.handle(method, null) }
+            }
+            assertEquals("Unsupported method", error.message)
+        }
+        assertEquals(0, requested)
+    }
+
+    @Test
+    fun failures_are_logged_and_rethrown_without_payloads() {
+        val logs = mutableListOf<String>()
+        val bridge = NostrBridge(
+            signerProvider = { throw IllegalStateException("boom") },
+            log = { logs += it },
+            logError = { message, _ -> logs += message }
+        )
+
+        assertThrows(IllegalStateException::class.java) {
+            runBlocking {
+                bridge.handle("nip44_encrypt", JSONObject().put("pubkey", pubkey).put("plaintext", "secret text"))
+            }
+        }
+
+        assertEquals(listOf("Request: nip44_encrypt", "nip44_encrypt failed"), logs)
+        assertTrue(logs.none { "secret text" in it })
+    }
+
+    private class RecordingSigner : NostrSigner {
+        val calls = mutableListOf<List<String>>()
+
+        override suspend fun getPublicKey(): String = "pk".also { calls += listOf("getPublicKey") }
+        override suspend fun signEvent(eventJson: String): String = "signed".also { calls += listOf("signEvent", eventJson) }
+        override suspend fun nip04Encrypt(pubkey: String, plaintext: String) = "c04".also { calls += listOf("nip04Encrypt", pubkey, plaintext) }
+        override suspend fun nip04Decrypt(pubkey: String, ciphertext: String) = "p04".also { calls += listOf("nip04Decrypt", pubkey, ciphertext) }
+        override suspend fun nip44Encrypt(pubkey: String, plaintext: String) = "c44".also { calls += listOf("nip44Encrypt", pubkey, plaintext) }
+        override suspend fun nip44Decrypt(pubkey: String, ciphertext: String) = "p44".also { calls += listOf("nip44Decrypt", pubkey, ciphertext) }
+    }
+}

package/android-template/gradle/libs.versions.toml

@@ -17,6 +17,7 @@ json = "20250517"
 okhttp = "4.12.0"
 securityCrypto = "1.1.0"
 zxingCore = "3.5.3"
+webkit = "1.18.0"
 
 [libraries]
 androidx-appcompat = { module = "androidx.appcompat:appcompat", version.ref = "appcompat" }
@@ -42,6 +43,7 @@ json = { module = "org.json:json", version.ref = "json" }
 okhttp = { module = "com.squareup.okhttp3:okhttp", version.ref = "okhttp" }
 androidx-security-crypto = { module = "androidx.security:security-crypto", version.ref = "securityCrypto" }
 zxing-core = { module = "com.google.zxing:core", version.ref = "zxingCore" }
+androidx-webkit = { module = "androidx.webkit:webkit", version.ref = "webkit" }
 
 [plugins]
 android-application = { id = "com.android.application", version.ref = "agp" }

package/desktop-runtime/README.md

@@ -0,0 +1,108 @@
+# Pakstr desktop runtime
+
+Electron runtime that hosts a Pakstr web app on desktop, mirroring the Android
+shell's contracts. `pakstr build --target macos-arm64|windows-x64|linux-x64`
+stages this bundle with the app (`src/desktop/` in the CLI); the bundle ships
+in the CLI's npm package. All targets package the same bundle; only the menu
+differs (`src/appMenu.js`).
+
+## Build
+
+```sh
+npm --prefix packages/cli ci
+npm --prefix packages/cli run build   # tsc, then bundles dist/main.js and dist/preload.js
+```
+
+`npm --prefix packages/cli/desktop-runtime install` is only needed to run the
+runtime unpackaged with the `electron` dev binary.
+
+`dist/main.js` and `dist/preload.js` are self-contained: only `electron` and
+Node built-ins are left external (the build fails otherwise), so a generated
+app needs no `node_modules`. Third-party code and `src/shared` come from the
+CLI package. The `debug` package is compiled out because applesauce logs
+NIP-46 request params through it.
+
+## Generated app layout
+
+```
+<appRoot>/package.json          "main" -> the bundled main.js (preload.js beside it)
+<appRoot>/pakstr-desktop.json   { "appId": "com.example.app", "appName": "Example" }
+<appRoot>/web/                  staged web assets, incl. pakstr-runtime.json
+```
+
+## Behaviour
+
+- The app is served from `pakstr://app` (standard, secure scheme) with the
+  Android SPA fallback. `/api/*` is proxied to the effective API base
+  (persisted override, then packaged `apiBase`, then disabled). API cookies
+  live in the session cookie jar and never reach the renderer, and neither
+  do `Set-Cookie` or `Location`. Redirects are not followed.
+- NIP-98: `X-Forwarded-Host: app` / `X-Forwarded-Proto: pakstr` are added
+  only when the event's unique `u` tag is exactly the local request URL.
+- `window.nostr` (plain and writable, like `nip07.js`) and the synchronous
+  `window.PakstrBridge.getApiBaseUrl()` / `setApiBaseUrl(url)` exist only in
+  the main window's `pakstr://app` top frame. The first `window.nostr` call
+  without a signer opens a `nostrconnect://` pairing prompt that uses the
+  strict `src/shared/nip46Pairing` module.
+- All renderers are sandboxed with context isolation. Top-level navigation
+  stays on `pakstr://app`, `window.open` is denied, and web permissions are
+  denied except clipboard write and fullscreen. DevTools are available only
+  when unpackaged, and a packaged app exits if launched with a
+  remote-debugging or certificate-bypass switch. The runtime never disables
+  Chromium's sandbox.
+- All data (cookies, storage, API base override) lives in
+  `<appData>/<appId>`. The Electron app name is also the appId, because it
+  names the keychain item holding the cookie-encryption key ("<name> Safe
+  Storage"): renaming `appName` keeps sessions. The macOS menu shows `appName`.
+
+## Windows: not yet verified on a Windows machine
+
+Windows packages are cross-built and checked structurally (executable
+metadata, fuses, asar integrity, portable ZIP contents, NSIS output), but
+nothing here runs them. Before relying on `windows-x64`, check on real Windows
+10/11 x64:
+
+- The installer runs without admin rights. The Start menu shortcut, the
+  Apps & features entry, and the finish-page launch work, and uninstalling
+  removes everything except `%APPDATA%\<appId>`.
+- Reinstalling or upgrading over a running app prompts to close it, and an
+  upgrade that renames `appName` leaves no old `.exe` or shortcut behind.
+- The portable ZIP runs after extraction, including from a path with spaces
+  or non-ASCII characters.
+- The app starts with the asar-integrity and `OnlyLoadAppFromAsar` fuses on.
+  `pakstr://app` loads, `/api` proxying, cookies (DPAPI), `window.nostr`,
+  NIP-46 pairing, and signer auth links work, and a second launch focuses the
+  first window.
+- Taskbar pinning: Electron's default AppUserModelID may not match the
+  installer's shortcut (it has no AUMID), so a pin from the Start menu can
+  show as a separate taskbar button.
+- SmartScreen shows the unsigned-publisher warning; there is no Authenticode
+  signing yet.
+
+## Linux: not yet verified on a Linux machine
+
+Linux packages are cross-built and checked structurally (pinned AppImage
+runtime, root-owned squashfs with exact modes, desktop entry, icon, portable
+ZIP modes, fuses, asar hashes), but nothing here runs them. Electron enforces
+embedded asar integrity on macOS and Windows only, so on Linux the read-only
+AppImage filesystem and the build-time checks are what protect `app.asar`.
+Before relying on `linux-x64`, check on real x64 distributions (e.g. Ubuntu
+22.04 and 24.04, Fedora, Debian 12):
+
+- The AppImage starts with FUSE 3 (`fusermount3`), and with
+  `--appimage-extract-and-run` without FUSE; the portable ZIP runs after
+  `unzip`, including from a path with spaces.
+- Chromium's sandbox: with unprivileged user namespaces available the app
+  starts sandboxed. Where they are restricted (Ubuntu 23.10+ AppArmor) it
+  is expected to abort rather than run unsandboxed; record the message. The
+  runtime never passes `--no-sandbox`, and `chrome-sandbox` is not setuid.
+- `pakstr://app` loads, `/api` proxying, `window.nostr`, NIP-46 pairing, and
+  signer auth links (`xdg-open`) work, and a second launch focuses the first
+  window.
+- Cookies are encrypted with the desktop keyring (Secret Service / KWallet);
+  without one, Chromium falls back to a fixed key, so check which backend is
+  used.
+- The window class / Wayland app id is the appId, so desktop integration
+  (AppImageLauncher, appimaged) groups the window with the desktop entry and
+  shows the icon. Required system libraries (GTK 3, NSS, libgbm, ALSA, ...)
+  are those of any Chromium build and are not bundled.