AppImage job: pinned appimagetool + type2 runtime from BlueGit with checksums, --runtime-file; no GitHub at run time (Tim t1032u)

timfa Grok Bot · pushed by timfa

Authored 2026-11-08 · 6 days ago

Hash: 881d4c0eacc0aff7fc7abc63f6f6e71ffbad90ae
Parent: 37ab536a

2 files changed +19 −11

README.md +1 −1

@@ -201,7 +201,7 @@ Highres is exactly 8× on both axes; batch targets are currently **1–256 pixel

201 201

202 202 ## Releases and packages

203 203

204

A pushed `vX.Y.Z` tag (protected pattern `v*`) runs the tag pipeline: tests, then the AppImage, Debian/Ubuntu `.deb`, Arch `.pkg.tar.zst` and Windows zip, a package check with `SHA256SUMS`, and the release job, which publishes those files as the release of that existing tag on BlueGit (`https://git.timfalken.com/golden-age/paperdoll-renderer/-/releases`). It then updates the AUR package `paperdoll-renderer-bin` from the release's `.deb` (`yay -S paperdoll-renderer-bin`).

204

A pushed `vX.Y.Z` tag (protected pattern `v*`) runs the tag pipeline: tests, then the AppImage, Debian/Ubuntu `.deb`, Arch `.pkg.tar.zst` and Windows zip, a package check with `SHA256SUMS`, and the release job, which publishes those files as the release of that existing tag on BlueGit (`https://git.timfalken.com/golden-age/paperdoll-renderer/-/releases`). It then updates the AUR package `paperdoll-renderer-bin` from the release's `.deb` (`yay -S paperdoll-renderer-bin`). The AppImage job downloads nothing from GitHub. It gets the pinned appimagetool 1.9.1 and type2-runtime 20251108 from the release assets of BlueGit's `golden-age/appimage-tools`, checks their SHA-256 values against the ones pinned in `scripts/package/appimage.sh`, and builds with `--runtime-file`.

205 205

206 206 ## Open with

207 207

@@ -201,7 +201,7 @@ Highres is exactly 8× on both axes; batch targets are currently **1–256 pixel

201

202## Releases and packages

203

204

A pushed `vX.Y.Z` tag (protected pattern `v*`) runs the tag pipeline: tests, then the AppImage, Debian/Ubuntu `.deb`, Arch `.pkg.tar.zst` and Windows zip, a package check with `SHA256SUMS`, and the release job, which publishes those files as the release of that existing tag on BlueGit (`https://git.timfalken.com/golden-age/paperdoll-renderer/-/releases`). It then updates the AUR package `paperdoll-renderer-bin` from the release's `.deb` (`yay -S paperdoll-renderer-bin`).

204

A pushed `vX.Y.Z` tag (protected pattern `v*`) runs the tag pipeline: tests, then the AppImage, Debian/Ubuntu `.deb`, Arch `.pkg.tar.zst` and Windows zip, a package check with `SHA256SUMS`, and the release job, which publishes those files as the release of that existing tag on BlueGit (`https://git.timfalken.com/golden-age/paperdoll-renderer/-/releases`). It then updates the AUR package `paperdoll-renderer-bin` from the release's `.deb` (`yay -S paperdoll-renderer-bin`). The AppImage job downloads nothing from GitHub. It gets the pinned appimagetool 1.9.1 and type2-runtime 20251108 from the release assets of BlueGit's `golden-age/appimage-tools`, checks their SHA-256 values against the ones pinned in `scripts/package/appimage.sh`, and builds with `--runtime-file`.

205

206## Open with

207

scripts/package/appimage.sh +18 −10

@@ -1,6 +1,8 @@

1 1 #!/usr/bin/env bash

2 2 # Build a Linux x86_64 AppImage.

3 # appimagetool 1.9.1 is pinned. The checksum is of that GitHub release asset.

3 # appimagetool 1.9.1 and type2-runtime 20251108 are pinned and come from

4 # BlueGit (golden-age/appimage-tools release assets, Tim t1032u); no GitHub at

5 # run time. The checksums match the upstream GitHub release assets.

4 6 set -euo pipefail

5 7

6 8 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"

@@ -10,16 +12,22 @@ version="$(bash "$root/scripts/ci/package-version.sh")"

10 12 build_linux_release "$root"

11 13

12 14 tool_dir="${APPIMAGETOOL_DIR:-$root/dist/tools}"

tools_url="${APPIMAGE_TOOLS_URL:-https://git.timfalken.com/golden-age/appimage-tools/-/releases/appimagetool-1.9.1_runtime-20251108/assets}"

13 16 tool="$tool_dir/appimagetool-x86_64.AppImage"

14 expected="ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0"

17 runtime="$tool_dir/runtime-x86_64"

15 18 mkdir -p "$tool_dir"

16 if [[ ! -f "$tool" ]] || [[ "$(sha256sum "$tool" | awk '{print $1}')" != "$expected" ]]; then

17 curl -fL --retry 3 -o "$tool.partial" \

18 "https://github.com/AppImage/appimagetool/releases/download/1.9.1/appimagetool-x86_64.AppImage"

19 echo "${expected} ${tool}.partial" | sha256sum -c -

20 mv "$tool.partial" "$tool"

21 chmod +x "$tool"

22 fi

19 fetch_pinned() { # FILE SHA256

20 local file="$tool_dir/$1"

21 if [[ -f "$file" ]] && [[ "$(sha256sum "$file" | awk '{print $1}')" == "$2" ]]; then

22 return

23 fi

24 curl -fL --retry 3 -o "$file.partial" "$tools_url/$1"

25 echo "$2 $file.partial" | sha256sum -c -

26 mv "$file.partial" "$file"

27 }

28 fetch_pinned appimagetool-x86_64.AppImage ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0

29 fetch_pinned runtime-x86_64 2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d

30 chmod +x "$tool"

23 31

24 32 stage="$(mktemp -d)"

25 33 chmod 755 "$stage"

@@ -49,7 +57,7 @@ chmod +x "$stage/AppRun"

49 57 mkdir -p "$root/dist"

50 58 export ARCH=x86_64

51 59 export APPIMAGE_EXTRACT_AND_RUN=1

52 "$tool" "$stage" "$root/dist/paperdoll-renderer-${version}-x86_64.AppImage"

60 "$tool" --runtime-file "$runtime" "$stage" "$root/dist/paperdoll-renderer-${version}-x86_64.AppImage"

53 61 cp -f "$root/dist/paperdoll-renderer-${version}-x86_64.AppImage" "$root/dist/paperdoll-renderer-x86_64.AppImage"

54 62 chmod +x "$root/dist/paperdoll-renderer-x86_64.AppImage"

55 63 echo "wrote dist/paperdoll-renderer-x86_64.AppImage"

@@ -1,6 +1,8 @@

1#!/usr/bin/env bash

2# Build a Linux x86_64 AppImage.

3# appimagetool 1.9.1 is pinned. The checksum is of that GitHub release asset.

3# appimagetool 1.9.1 and type2-runtime 20251108 are pinned and come from

4# BlueGit (golden-age/appimage-tools release assets, Tim t1032u); no GitHub at

5# run time. The checksums match the upstream GitHub release assets.

4set -euo pipefail

6set -euo pipefail

6root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"

8root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"

@@ -10,16 +12,22 @@ version="$(bash "$root/scripts/ci/package-version.sh")"

10build_linux_release "$root"

12build_linux_release "$root"

12tool_dir="${APPIMAGETOOL_DIR:-$root/dist/tools}"

14tool_dir="${APPIMAGETOOL_DIR:-$root/dist/tools}"

tools_url="${APPIMAGE_TOOLS_URL:-https://git.timfalken.com/golden-age/appimage-tools/-/releases/appimagetool-1.9.1_runtime-20251108/assets}"

13tool="$tool_dir/appimagetool-x86_64.AppImage"

16tool="$tool_dir/appimagetool-x86_64.AppImage"

14expected="ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0"

17runtime="$tool_dir/runtime-x86_64"

15mkdir -p "$tool_dir"

18mkdir -p "$tool_dir"

16if [[ ! -f "$tool" ]] || [[ "$(sha256sum "$tool" | awk '{print $1}')" != "$expected" ]]; then

19fetch_pinned() { # FILE SHA256

17 curl -fL --retry 3 -o "$tool.partial" \

20 local file="$tool_dir/$1"

18 "https://github.com/AppImage/appimagetool/releases/download/1.9.1/appimagetool-x86_64.AppImage"

21 if [[ -f "$file" ]] && [[ "$(sha256sum "$file" | awk '{print $1}')" == "$2" ]]; then

19 echo "${expected} ${tool}.partial" | sha256sum -c -

22 return

20 mv "$tool.partial" "$tool"

23 fi

21 chmod +x "$tool"

24 curl -fL --retry 3 -o "$file.partial" "$tools_url/$1"

22fi

25 echo "$2 $file.partial" | sha256sum -c -

26 mv "$file.partial" "$file"

27}

28fetch_pinned appimagetool-x86_64.AppImage ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0

29fetch_pinned runtime-x86_64 2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d

30chmod +x "$tool"

24stage="$(mktemp -d)"

32stage="$(mktemp -d)"

25chmod 755 "$stage"

33chmod 755 "$stage"

@@ -49,7 +57,7 @@ chmod +x "$stage/AppRun"

49mkdir -p "$root/dist"

57mkdir -p "$root/dist"

50export ARCH=x86_64

58export ARCH=x86_64

51export APPIMAGE_EXTRACT_AND_RUN=1

59export APPIMAGE_EXTRACT_AND_RUN=1

52"$tool" "$stage" "$root/dist/paperdoll-renderer-${version}-x86_64.AppImage"

60"$tool" --runtime-file "$runtime" "$stage" "$root/dist/paperdoll-renderer-${version}-x86_64.AppImage"

53cp -f "$root/dist/paperdoll-renderer-${version}-x86_64.AppImage" "$root/dist/paperdoll-renderer-x86_64.AppImage"

61cp -f "$root/dist/paperdoll-renderer-${version}-x86_64.AppImage" "$root/dist/paperdoll-renderer-x86_64.AppImage"

54chmod +x "$root/dist/paperdoll-renderer-x86_64.AppImage"

62chmod +x "$root/dist/paperdoll-renderer-x86_64.AppImage"

55echo "wrote dist/paperdoll-renderer-x86_64.AppImage"

63echo "wrote dist/paperdoll-renderer-x86_64.AppImage"