Cherry-picked from PR #377 (thanks @Mar0xy) — Node-only portion, no
Discord IPC additions:
- 4 workflows (release-{linux,linux-aarch64,macos,flatpak}.yml) now
install Node 24
- packaging/flatpak/com.blitzfc.qbz.yml: SDK extension node20 → node24,
build append-path and npm_config_nodedir aligned
Forcing function: @icons-pack/svelte-simple-icons@7.x already in use
declares engines.node >=24, so Node 20 produces an EBADENGINE warning
in CI. Node 20 also reached EOL on 2026-04-30. Node 24 has been LTS
since October 2025 (~7 months of maturity).
Discord IPC permissions and qbz-wrapper script from #377 were
intentionally NOT cherry-picked — there's no Discord RPC feature in
QBZ today (#336 is still planned but not implemented), so adding the
sandbox permission and the launch wrapper now would expand the
attack surface for nothing. They'll land together with the actual
feature when it ships.
cc
The qbzd daemon is still in early development and the build pipeline
isn't ready to ship artifacts. Drop the workflow until the daemon
work lands so it doesn't fire on tag push and produce broken jobs.
cc
Triaged the 8 open CodeQL alerts raised on the 1.2.5 merge commit.
Critical (1) — real, fixed:
* .github/workflows/release-updater-manifest.yml:29 — the resolve
step interpolated `${{ github.event.workflow_run.head_branch }}`
directly into a shell heredoc. `head_branch` on `workflow_run` is
attacker-controllable (any outside contributor can push a branch
whose name embeds a payload). Route the value through an env var
(HEAD_BRANCH) and validate the shape with a strict regex before
letting it flow into shell or $GITHUB_OUTPUT.
Warnings (2) — real, fixed:
* .github/workflows/build-qbzd.yml had no `permissions:` block, so
every job inherited the repo's default GITHUB_TOKEN scope. Add a
top-level `permissions: contents: read`; the existing `release`
job keeps its own `contents: write` override for publishing
artifacts.
Warnings (3) — real, low severity, mitigated:
* crates/qbzd/src/{daemon.rs,session.rs} logged `user_id` at info
level (CodeQL rust/cleartext-logging). Demoted the three lines to
`log::debug!` so default-level logs stay free of the numeric user
id, with a comment noting RUST_LOG=debug re-enables them for
diagnostics.
Warnings (2) — false positives, dismissed in GitHub:
* crates/qbzd/src/login.rs:103 — `println!` to stdout inside the
interactive `qbzd login` subcommand; login confirmation UX, not a
persistent log. (alert #63 dismissed, reason: false positive)
* crates/qbzd/src/qconnect.rs:540 — `session_uuid` is an ephemeral
per-connection identifier QConnect exchanges in cleartext itself;
not a credential or token. (alert #65 dismissed, reason: false
positive)
cc
qbzd is feature-complete on disk but not ready for public release yet.
Keep all code paths in place so it can be unhidden with a one-line
flip, but remove it from the user-facing surface:
* build-qbzd.yml: comment out the `push.tags` trigger so neither a
regular `v*` version tag nor a `qbzd-v*` tag auto-builds artifacts.
workflow_dispatch is preserved for manual testing.
* CastPicker.svelte: guard the QBZ Daemon tab, the manual-connect
section, and the three `v2_qbzd_*` Tauri invocations behind a
`QBZD_ENABLED` flag (currently false). Default activeProtocol
switches to 'chromecast' so the picker doesn't start on a hidden
tab.
* SettingsView: DAC Setup Wizard icon filter swapped — button icon
drops the `invert(1)` so it reads on light accent colors (e.g.
Catppuccin Lavender), and the tooltip copy of the same icon now
has `invert(1)` so it reads on the dark surface bg. Unrelated to
qbzd but bundled since both are pre-release polish.
cc
Adds TAURI_SIGNING_PRIVATE_KEY(_PASSWORD) env to release-linux,
release-linux-aarch64, and release-macos build steps, collects the
resulting .sig files into the release artifacts, and adds a new
release-updater-manifest workflow that waits for all platform sig
files to land on the release and assembles latest.json for the
updater endpoint.
Cherry-picked from #305 by @afonsojramos.
cc
QEMU emulation crashes compiling ring's C code (SIGSEGV in cc).
Switch to ubuntu-24.04-arm native runner — faster and no emulation
issues. Build time drops from ~40min to ~5min.
cc
Ubuntu runners' apt multi-arch is broken for arm64 cross-deps
(security.ubuntu.com 404s for arm64 packages, DEB822 format
sources not handled by sed).
Switch to uraimo/run-on-arch-action: builds natively inside a
Debian Bookworm aarch64 container via QEMU. Slower (~15 min)
but reliable. Binary is native aarch64 with Bookworm's glibc 2.36.
cc
The sed was only modifying /etc/apt/sources.list but security.ubuntu.com
and other sources in sources.list.d/ were also trying to fetch arm64
packages from repos that don't have them (404).
Now: force [arch=amd64] on ALL .list files, arm64 exclusively from
ports.ubuntu.com.
cc
glibc 2.31 is too old for system shared libs (libasound, libdbus)
on Ubuntu 22.04 runners which have glibc 2.35. The linker rejects
symbols from libs compiled against newer glibc.
glibc 2.35 covers: Raspberry Pi OS Bookworm (2.36), Ubuntu 22.04+,
Armbian Bookworm, DietPi Bookworm. Bullseye (2.31) is EOL June 2026.
cc
reqwest default features included native-tls which pulled in
openssl-sys. This broke zigbuild cross-compilation because zig's
C compiler doesn't support the glibc version suffix for openssl
header expansion.
Fix: default-features = false on reqwest in workspace and
qbz-integrations (which had its own reqwest dep with defaults).
Now the entire daemon tree uses rustls-tls exclusively.
cc
Uses cargo-zigbuild to target glibc 2.31 for maximum compatibility:
- Raspberry Pi OS Bullseye and newer
- DietPi, Armbian, Ubuntu 22.04+
Triggered by qbzd-v* tags or manual dispatch.
Produces two binaries: qbzd-linux-x86_64, qbzd-linux-aarch64.
Creates pre-release on tag push.
cc
- Upgrade rust_cast 0.18.1 → 0.21 (switches from openssl to rustls,
removing the openssl-sys dependency that blocked x86_64 cross-compile)
- Split mupdf sys-lib features to Linux-only (on macOS there are no GTK
symbol conflicts, and system libs don't support x86_64 cross-compile
from Apple Silicon)
- Update release-macos workflow to build both aarch64 and x86_64 DMGs
using a matrix strategy
Ebuilds without matching Manifest hashes cause 'Missing digest'
errors on emerge. Download DIST files and compute BLAKE2B/SHA512
for ebuilds, metadata.xml, and tarballs.
cc
When a new issue selects macOS as platform, automatically labels it
platform:macos and assigns afonsojramos. Linux issues get labeled
platform:linux.
cc
Adds Linux/macOS selection as first field in bug reports, feature
requests, and feedback forms. Adapts Linux-specific fields (DE, display
server) to indicate they are Linux-only and adds macOS options to
install method and audio backend dropdowns.
cc
Builds DMG for both Apple Silicon (aarch64) and Intel (x86_64).
Triggered on tag push or manual dispatch. Artifacts uploaded to
GitHub Releases as pre-release.
Unsigned — users bypass Gatekeeper with right-click > Open.
cc
Triggered by release-linux completion (same as AUR).
Updates ebuilds in vicrodh/qbz-overlay with new version.
Requires OVERLAY_PAT secret for cross-repo push.
cc
Replaces placeholder-text markdown templates with structured YAML
issue forms. Dropdowns for installation method, display server, and
audio backend. Required fields for description, steps, and version.
Same output format when reading submitted issues.
cc
- dependabot.yml: target pre-release branch for npm and cargo updates
- redirect-pr-to-prerelease.yml: auto-redirect PRs to main → pre-release
with a friendly comment explaining the workflow
- Add flac; keyword to all .desktop files (was only in deb template)
- Add StartupNotify=true to flatpak .desktop files (was missing)
- Add Keywords line to snap .desktop (was missing entirely)
- Unify shortDescription to match other .desktop Comment fields
cc
The Tauri .desktop template was missing %u in the Exec line, preventing
the desktop environment from passing qobuzapp:// URIs as arguments when
launched from the browser. The tarball .desktop was also missing MimeType,
StartupWMClass, and StartupNotify fields.
Closes#44
cc
Add [[bin]] section to Cargo.toml so cargo produces target/release/qbz
directly. Update all packaging references (workflows, PKGBUILD, Flatpak
manifest, AUR desktop file) to use the new binary name. This fixes DEB
and RPM packages installing the binary as /usr/bin/qbz-nix instead of
/usr/bin/qbz.
- Change trigger from release:published to workflow_run on release-linux
- Only run if the triggering workflow succeeded
- Increase timeout to 30 minutes for aarch64 build to complete
- Extract version from workflow's head branch (the tag)
Bug report now asks for installation method, display server, GPU,
and includes step-by-step instructions for sharing logs via the
built-in log uploader. Crash recovery hint for startup crashes.
Feedback template also adds installation method field.
The AppImage EGL_BAD_PARAMETER crash is caused by how Tauri's
linuxdeploy bundles newer WebKitGTK versions (tauri-apps/tauri#11994).
Fix: pin WebKitGTK to 2.44.0-2 on ubuntu-24.04, matching the proven
fix from other Tauri apps (audioling#40, OmniKee).
Also revert runtime env var workarounds (LIBGL_ALWAYS_SOFTWARE,
default-off hardware accel) since the fix is at the build level.
Keep only the NVIDIA DMA-BUF workaround which is still needed.
On release events pkgrel defaults to 1. On manual dispatch it can be
set to any value (default 1), allowing same-version rebuilds like
1.1.9-2 without editing the workflow.
Flatpak uses the <releases> section in metainfo.xml to display the
application version. Added a placeholder release entry and updated
the workflow to inject the actual version and date during build.
vicrodh