Skip to content

Commit 5aaba82

Browse files
ShadowfetchStudioShadowfetchStudio
committed
Package the native desktop with verified dependency notices
1 parent 0441b97 commit 5aaba82

37 files changed

Lines changed: 11216 additions & 18 deletions

‎.github/workflows/native.yml‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,15 @@ on:
33
push:
44
branches: [native-0.20]
55
pull_request:
6-
paths: ['native/**', 'src-tauri/**', 'ui/**', 'scripts/test-native-desktop.mjs', 'Cargo.toml', 'Cargo.lock', '.github/workflows/native.yml']
6+
paths: ['native/**', 'src-tauri/**', 'ui/**', 'licenses/native/**', 'scripts/*native*.mjs', 'Cargo.toml', 'Cargo.lock', '.github/workflows/native.yml']
77
permissions:
88
contents: read
99
jobs:
1010
verify:
1111
runs-on: ubuntu-24.04
12+
timeout-minutes: 45
13+
env:
14+
RUSTUP_TOOLCHAIN: '1.95.0'
1215
steps:
1316
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
1417
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
@@ -34,3 +37,26 @@ jobs:
3437
name: native-window-diagnostics
3538
path: artifacts/native
3639
- run: cargo +1.95.0 build --release -p shadowcode-core --examples --locked
40+
- name: Build native development packages with dependency notices
41+
run: node scripts/build-native.mjs
42+
- name: Inspect both packages
43+
run: node scripts/check-native-package.mjs target/release/bundle/appimage/ShadowCode_0.20.0_amd64.AppImage target/release/bundle/deb/ShadowCode_0.20.0_amd64.deb
44+
- name: Exercise the packaged native window
45+
env:
46+
SHADOW_DESKTOP_BINARY: ${{ github.workspace }}/target/release/bundle/appimage/ShadowCode_0.20.0_amd64.AppImage
47+
SHADOW_DESKTOP_ARGS: '["--appimage-extract-and-run","ui"]'
48+
SHADOW_NATIVE_ARTIFACTS: artifacts/native-package/window
49+
run: xvfb-run -a -s '-screen 0 1440x1100x24' dbus-run-session -- node scripts/test-native-desktop.mjs
50+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
51+
if: always()
52+
with:
53+
name: native-package-diagnostics
54+
path: artifacts/native-package
55+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
56+
with:
57+
name: native-linux-development
58+
retention-days: 14
59+
path: |
60+
target/release/bundle/appimage/*.AppImage
61+
target/release/bundle/deb/*.deb
62+
artifacts/native-package/SHA256SUMS

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@
1414
from the drawer.
1515
- Native window automation covers actual tool execution, approvals, reload,
1616
cancellation, goal progression/pause, accessibility, and subprocess cleanup.
17+
- Native AppImage and Debian build scripts preserve per-format executable
18+
metadata, include versioned dependency notices, and check startup, versions,
19+
matching compiled code, notice hashes, and absence of Python sidecars. The
20+
packaged AppImage runs the same real-window workflow as the debug executable.
1721

1822
This development branch is not yet the replacement release. Remaining
1923
integrations, broader stress checks, packaging, and installation are tracked in

‎README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,9 @@ context, tools, permissions, checkpoints, plans, and verification.
1313
**Native 0.20 development:** the `native-0.20` branch now builds a Rust/Tauri
1414
desktop window with the interface embedded in the executable. It needs no Python
1515
runtime or browser launcher. See the [native development guide](docs/NATIVE_DESKTOP.md)
16-
and [goals workflow](docs/NATIVE_GOALS.md). Integrations and release checks are
16+
and [goals workflow](docs/NATIVE_GOALS.md). Development AppImage and Debian
17+
packages include [dependency inventories and notices](licenses/native/README.md).
18+
Integrations and release checks are
1719
still in progress under the [migration gates](docs/NATIVE_MIGRATION.md);
1820
0.19 remains the supported download below.
1921

‎docs/NATIVE_DESKTOP.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,41 @@ Model inference remains in Ollama or the selected provider; it is not bundled.
4040

4141
To work on the live interface, run `./ui/node_modules/.bin/tauri dev` from the
4242
repository root. The Tauri configuration starts Vite and builds the native app.
43+
Build hooks explicitly use the `ui` directory, including when the CLI is invoked
44+
from the repository root.
45+
46+
## Development packages
47+
48+
From the repository root, build both package formats with:
49+
50+
```sh
51+
node scripts/build-native.mjs
52+
node scripts/check-native-package.mjs \
53+
target/release/bundle/appimage/ShadowCode_0.20.0_amd64.AppImage \
54+
target/release/bundle/deb/ShadowCode_0.20.0_amd64.deb
55+
```
56+
57+
The build script collects [dependency notices](../licenses/native/README.md),
58+
restores the original executable before packaging each format because Tauri
59+
modifies its bundle-type marker, and repacks the AppImage with notices for its
60+
actual bundled system libraries. Build tools are cached in `target/.tauri/`.
61+
Unknown dependencies or a changed AppImage runtime stop packaging until their
62+
notices are supplied. The checker verifies FUSE-free
63+
startup, the legacy `shadow ui` launch form, native ELF code, package versions,
64+
dependency resolution on the build host, and absence of Python interpreters,
65+
libraries, and sidecars. It also verifies the SHA-256 digest of every listed
66+
notice in each extracted package. It produces checksums in `artifacts/native-package/`.
67+
68+
The initial local packages contain an approximately 17 MB executable, an 80 MB
69+
AppImage (including native GTK/WebKit libraries), and a 7.5 MB Debian package
70+
(using system GTK/WebKit), before the notice inventory was added. These are
71+
development artifacts. Corresponding-source release artifacts, clean-runner
72+
package verification, complete feature migration, and release
73+
installation are still required before publication as the supported download.
74+
75+
If linuxdeploy aborts while scanning an inaccessible symlink in a PATH directory,
76+
remove that directory from PATH for the packaging command; the application does
77+
not require that tool. No global PATH change is needed.
4378

4479
## Desktop integration
4580

@@ -84,6 +119,12 @@ light/dark/compact/goals accessibility, and managed shutdown. It also verifies
84119
that the executable embeds the current compiled interface and does not load
85120
`libpython`.
86121

122+
To run this same workflow against the actual AppImage, set
123+
`SHADOW_DESKTOP_BINARY` to its absolute path,
124+
`SHADOW_DESKTOP_ARGS='["--appimage-extract-and-run","ui"]'`, and
125+
`SHADOW_NATIVE_ARTIFACTS` to a separate output directory. Its test profile and
126+
workspace remain disposable, so it does not migrate the installed app's data.
127+
87128
See [verification evidence](NATIVE_VERIFICATION.md) for engine stress tests and
88129
separate real-model coding probes. The scripted window test establishes UI and
89130
engine integration; the real-model probes establish provider/tool behavior.

‎docs/NATIVE_MIGRATION.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ the existing React visual design. This document tracks engineering acceptance;
4646
- Exercise both the real native window and the browser test transport. Verify
4747
accessibility and appearance at desktop and compact sizes.
4848
- Build on a clean CI runner, verify the downloadable artifact on this machine,
49+
include dependency notices and checked package metadata,
4950
update all user/developer/security/release documentation and repository info,
5051
publish source plus checksummed binaries to GitHub, and install the verified
5152
release in Applications while retaining user data.
@@ -103,6 +104,13 @@ Implemented foundation:
103104
The default inspection requires current reads; final verification requires a
104105
recorded successful command. Failed verification blocks further progression.
105106
Manual checklist edits are labelled and disallowed while the goal is running.
107+
- Repeatable Linux AppImage and Debian packaging with the native ELF executable,
108+
embedded UI, legacy `shadow ui` launcher compatibility, exact version metadata,
109+
and package inspection for Python runtimes or sidecars. Both packages contain
110+
application dependency notices; the AppImage adds an inventory and copyright
111+
texts for its actual bundled libraries. Package checks verify every listed
112+
notice's checksum. Corresponding-source artifacts and final release validation
113+
remain separate gates.
106114

107115
The remaining orchestration/integrations, full desktop interaction/stress
108116
coverage, and release packaging are still in progress. The native

‎docs/NATIVE_VERIFICATION.md‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,9 +73,21 @@ Eleven interface unit tests cover ordered replay, pagination, stream finalizatio
7373
listener cleanup, interruption, and native tool cards. The seven existing browser
7474
tests continue to pass through the legacy transport.
7575

76+
The same native window workflow also passes when launched from the local release
77+
AppImage in FUSE-free extraction mode with the legacy `ui` argument. The package
78+
checker confirms that AppImage and Debian packages contain native ELF application
79+
code with matching versions and no Python runtime or sidecars. Packaging now
80+
collects notices for 523 application dependencies, including the resolved Cargo
81+
build/test graph and production npm graph. The local AppImage inventory records
82+
156 system packages; that number depends on the build host's libraries and GTK
83+
data. Unattributed system files stop packaging, and the extracted-package check
84+
verifies the SHA-256 digest of every listed notice. Exact source package versions
85+
are retained for corresponding-source release preparation.
86+
7687
OS dialog interaction, notification delivery, default-profile single-instance
7788
behavior, broader stress/accessibility coverage, real models through the native
78-
window, and final release packages still need their release-gate checks.
89+
window, corresponding-source artifacts, clean-runner package builds, and the final installed
90+
release still need their release-gate checks.
7991

8092
## Real local models
8193

‎licenses/native/README.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Native dependency notice sources
2+
3+
These are unmodified upstream license and copyright texts, retained when the
4+
published crate omits them, plus notices for the Rust standard library and the
5+
AppImage helpers. `sources.json` records their exact source commits or archives
6+
and SHA-256 digests. Crate overrides are specific to the resolved version;
7+
changing a dependency with no notice text fails packaging until its attribution
8+
is supplied. The selectors crate declares MPL-2.0 in its source headers; its
9+
complete license text comes from Mozilla.
10+
11+
The Rust library notices come from the official 1.95.0 compiler distribution,
12+
whose archive digest was checked against the distribution's checksum. Changing
13+
the compiler requires updating these standard-library notices. The AppImage
14+
runtime is also checked during packaging before its notices are used.
15+
16+
`scripts/native-notices.mjs` collects notices from the installed, locked Cargo
17+
and npm dependencies. The Cargo inventory includes the target's resolved build
18+
and test dependencies, and the npm inventory includes all production packages.
19+
Both inventories deliberately include some code eliminated during bundling.
20+
They should not be interpreted as a list of functions present in the executable.
21+
22+
After linuxdeploy gathers the AppImage, the collector matches its libraries and
23+
data files to the build host's package database, retains the distro copyright
24+
files and common license texts, and records exact binary and source versions.
25+
Unattributed system files stop packaging. The resulting application and system
26+
inventories live under `usr/share/doc/shadowcode/notices` inside the AppImage.
27+
The Debian package contains the application notices and uses system libraries.
28+
The package checker verifies every listed notice's digest after extraction.
29+
30+
This inventory is part of release preparation. Corresponding source archives
31+
for redistributed components and the remaining product verification gates must
32+
also be addressed before the supported native release is published.

‎licenses/native/alloc-stdlib-0.2.4/LICENSE‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Copyright (c) 2016 Dropbox, Inc.
2+
All rights reserved.
3+
4+
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
5+
6+
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
7+
8+
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
9+
10+
3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
11+
12+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

‎licenses/native/appimage-runtime/LICENSE‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
MIT License
2+
3+
Copyright (c) 2004-23 probonopd
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.
22+
23+
The AppImage runtime executable contains statically linked code from
24+
the following third party libraries, which are licensed under
25+
the following terms:
26+
27+
* musl libc, licensed under the terms of
28+
https://git.musl-libc.org/cgit/musl/tree/COPYRIGHT
29+
* libfuse, licensed under the terms of
30+
https://github.com/libfuse/libfuse/blob/master/LGPL2.txt
31+
* squashfuse, licensed under the terms of
32+
https://github.com/vasi/squashfuse/blob/master/LICENSE
33+
* libzstd, licensed under the terms of
34+
https://github.com/facebook/zstd/blob/dev/LICENSE
35+
* zlib, licensed under the terms of
36+
https://zlib.net/zlib_license.html

‎licenses/native/appimagekit/LICENSE‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
MIT License
2+
3+
If not stated otherwise within the individual file or subdirectory, the
4+
original source code in this repository is licensed as below. This does not
5+
necessarily apply for all dependencies. For the sake of clarity, this license
6+
does NOT apply to the contents of AppImages that anyone may create.
7+
Software contained inside an AppImage may be licensed under any license at the
8+
discretion of the respecive rights holder(s).
9+
10+
Copyright (c) 2004-20 Simon Peter
11+
12+
Permission is hereby granted, free of charge, to any person obtaining a copy
13+
of this software and associated documentation files (the "Software"), to deal
14+
in the Software without restriction, including without limitation the rights
15+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
16+
copies of the Software, and to permit persons to whom the Software is
17+
furnished to do so, subject to the following conditions:
18+
19+
The above copyright notice and this permission notice shall be included in all
20+
copies or substantial portions of the Software.
21+
22+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
23+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
24+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
25+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
26+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
27+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
28+
SOFTWARE.

0 commit comments

Comments
 (0)