Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -39,4 +39,5 @@ docs/.vitepress/dist
# AI
.trae/*
.cursor/*
.claude/*
.claude/*
.qwen/*
123 changes: 123 additions & 0 deletions com.imsyy.SPlayer.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,123 @@
# Flatpak manifest for SPlayer - Test Version
#
# How to test:
# 1. Build: flatpak-builder --force-clean --user build-dir com.imsyy.SPlayer.yml
# 2. Install: flatpak-builder --force-clean --user --install build-dir com.imsyy.SPlayer.yml
# 3. Run: flatpak run com.imsyy.SPlayer
# 4. Clean: flatpak uninstall com.imsyy.SPlayer && rm -rf build-dir .flatpak-builder

id: com.imsyy.SPlayer
runtime: org.freedesktop.Platform
runtime-version: '24.08'
sdk: org.freedesktop.Sdk
sdk-extensions:
- org.freedesktop.Sdk.Extension.node22
- org.freedesktop.Sdk.Extension.rust-stable

command: run.sh

finish-args:
# Display server
- --socket=x11
- --socket=wayland
# Audio
- --socket=pulseaudio
# Network for music streaming
- --share=network
# GPU acceleration
- --device=dri
# File access
- --filesystem=home
- --filesystem=xdg-music
# Notifications
Comment on lines +28 to +32
Copy link

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

--filesystem=home gives the app full read/write access to the entire home directory, which is far broader than needed for a music player. Consider narrowing this to specific portals/paths (e.g., xdg-music only, potentially :ro, and rely on the file chooser portal for imports) to keep the Flatpak sandbox meaningful.

Copilot uses AI. Check for mistakes.
- --talk-name=org.freedesktop.Notifications
# DNS resolution and network services
- --system-talk-name=org.freedesktop.resolve1
- --talk-name=org.freedesktop.NetworkManager
- --talk-name=org.freedesktop.login1
# Allow all system bus access for network operations
- --socket=session-bus
- --socket=system-bus
Comment on lines +39 to +40
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

Granting full access to session-bus and system-bus is a significant security risk as it allows the application to interact with any service on the host's D-Bus, effectively bypassing the sandbox isolation. It is highly recommended to remove these and instead use --talk-name for specific interfaces the app requires (e.g., org.mpris.MediaPlayer2.* for media controls).

Comment on lines +35 to +40
Copy link

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

--socket=session-bus and --socket=system-bus grant broad D-Bus access and effectively defeat a large part of the Flatpak sandbox; they’re also redundant with the more specific --talk-name entries above. Consider removing the bus sockets and keeping only the minimal --talk-name/--system-talk-name permissions required for the app’s features.

Copilot uses AI. Check for mistakes.

modules:
- name: SPlayer
buildsystem: simple
build-options:
append-path: /usr/lib/sdk/node22/bin:/usr/lib/sdk/rust-stable/bin
env:
# Chinese npm mirror
NPM_CONFIG_REGISTRY: 'https://registry.npmmirror.com'
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Hardcoding a regional NPM registry mirror (npmmirror.com) reduces the portability of the manifest and may cause build failures or performance issues for users in different geographic locations. Consider removing this or making it a configurable build-arg.

# Skip electron binary download
ELECTRON_SKIP_BINARY_DOWNLOAD: '1'
NPM_CONFIG_STRICT_SSL: 'false'
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

Disabling SSL verification (NPM_CONFIG_STRICT_SSL: 'false') is a security vulnerability that exposes the build process to Man-in-the-Middle (MITM) attacks. This should be removed to ensure that dependencies are downloaded over a secure connection.

Comment on lines +48 to +52
Copy link

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ELECTRON_SKIP_BINARY_DOWNLOAD=1 will skip downloading the Electron binary during pnpm install, which typically leaves node_modules/electron/dist empty and causes electron-vite build / electron-builder to fail (or produce an unpacked app missing the Electron runtime). Consider removing this env var for the Flatpak build, or replace it with a deterministic approach (e.g., allow Electron download, or prefetch/populate an Electron cache and point ELECTRON_CACHE to it).

Copilot uses AI. Check for mistakes.
Comment on lines +49 to +52
Copy link

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting NPM_CONFIG_STRICT_SSL to false disables TLS certificate verification for npm, which is a supply-chain/security risk during builds. Prefer leaving strict SSL enabled and, if needed, configure the registry/CA properly (or vendor deps with Flatpak sources) instead of disabling verification.

Copilot uses AI. Check for mistakes.
# Network during build
build-args:
- --share=network
build-commands:
# Complete build script
- |
set -e

echo "=== Step 1: Installing pnpm ==="
npm install --prefix=/var/tmp pnpm@10
export PATH="/var/tmp/node_modules/.bin:$PATH"

echo "=== Step 2: Installing dependencies and building native modules ==="
# Build better-sqlite3 and other native modules
pnpm install --frozen-lockfile

# Rebuild native modules for Electron runtime
echo "=== Step 2b: Rebuilding native modules for Electron ==="
npx electron-builder install-app-deps

echo "=== Step 3: Building Rust native modules ==="
pnpm build:native

echo "=== Step 5: Building Electron app ==="
npx electron-vite build

echo "=== Step 5: Packaging with electron-builder ==="
# Build only unpacked directory, avoid pacman/rpm/deb
npx electron-builder --linux --config electron-builder-flatpak.ts
Comment on lines +76 to +81
Copy link

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The echoed step numbers are inconsistent ("Step 5" is used twice and Step 4 is skipped), which makes build logs harder to follow when debugging. Consider renumbering the steps to match the actual sequence.

Copilot uses AI. Check for mistakes.

echo "=== Step 6: Installing to Flatpak structure ==="
install -d /app/share/SPlayer
install -d /app/bin
install -d /app/share/applications
install -d /app/share/icons/hicolor/512x512/apps

# Copy built application
cp -r dist/linux-unpacked/* /app/share/SPlayer/

# Desktop entry
cat > /app/share/applications/com.imsyy.SPlayer.desktop << 'DESKTOP'
[Desktop Entry]
Name=SPlayer
Comment=A minimalist music player
Exec=run.sh %U
Icon=com.imsyy.SPlayer
Type=Application
Categories=Audio;Music;Player;AudioVideo;
MimeType=x-scheme-handler/orpheus;
StartupNotify=true
DESKTOP

# Icon
install -Dm644 public/icons/favicon-512x512.png /app/share/icons/hicolor/512x512/apps/com.imsyy.SPlayer.png

# Launcher script (disable SUID sandbox for Flatpak)
cat > /app/bin/run.sh << 'LAUNCHER'
#!/bin/bash
exec /app/share/SPlayer/SPlayer --no-sandbox "$@"
LAUNCHER
chmod +x /app/bin/run.sh

echo "=== Build Complete ==="

sources:
# Application source
- type: dir
path: .
# Custom electron-builder config
- type: file
path: electron-builder-flatpak.ts
Comment on lines +117 to +123
Copy link

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The sources list includes both type: dir with path: . and a separate type: file for electron-builder-flatpak.ts, but the file is already included in the directory source. Dropping the redundant type: file entry will simplify the manifest and avoid accidental divergence if the file path/name changes.

Copilot uses AI. Check for mistakes.
56 changes: 56 additions & 0 deletions electron-builder-flatpak.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
// Electron builder config for Flatpak (unpack directory only)
import type { Configuration } from "electron-builder";

const config: Configuration = {
appId: "com.imsyy.splayer",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The appId here (com.imsyy.splayer) is inconsistent with the Flatpak manifest ID (com.imsyy.SPlayer). This mismatch can cause issues with desktop integration features like notification grouping and taskbar icon association in some desktop environments. It is recommended to match the Flatpak ID exactly.

productName: "SPlayer",
copyright: "Copyright © imsyy 2023",
directories: {
Comment on lines +4 to +8
Copy link

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This Flatpak-specific electron-builder config largely duplicates electron-builder.config.ts (same app metadata, files list, resources, Linux settings), but it omits settings present in the main config (e.g., electronDownload.mirror at electron-builder.config.ts:205-208). To reduce drift and keep behavior consistent, consider importing the base config and overriding only the Flatpak-specific parts (Linux target=dir, arch list, any Flatpak-only asarUnpack changes).

Copilot uses AI. Check for mistakes.
buildResources: "build",
},
files: [
"public/**",
"out/**",
"!**/.vscode/*",
"!src/*",
"!electron.vite.config.{js,ts,mjs,cjs}",
"!{.eslintignore,.eslintrc.cjs,.prettierignore,.prettierrc.yaml,dev-app-update.yml,CHANGELOG.md,README.md}",
"!{.env,.env.*,.npmrc,pnpm-lock.yaml}",
],
asarUnpack: ["public/**", "**/node_modules/better-sqlite3/**"],
extraResources: [
{
from: "native/external-media-integration",
to: "native",
filter: ["*.node"],
},
{
from: "native/taskbar-lyric",
to: "native",
filter: ["*.node"],
},
{
from: "native/tools",
to: "native",
filter: ["*.node"],
},
],
linux: {
executableName: "SPlayer",
icon: "public/icons/favicon-512x512.png",
artifactName: "${name}-${version}-${arch}.${ext}",
// Only build unpacked directory for Flatpak
target: [
{
target: "dir",
arch: ["x64"],
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The build target is currently limited to x64. Since the project supports arm64 in its main configuration, adding it here will allow the Flatpak to be built for ARM-based Linux devices (like Raspberry Pi or ARM laptops) as well.

},
],
maintainer: "imsyy.top",
category: "Audio;Music;AudioVideo;",
},
npmRebuild: false,
publish: [],
};

export default config;
Loading