WaveFlow QuickPlay v1.5.0

WaveFlow QuickPlay 1.5.0

QuickPlay now runs on 64-bit Arm Linux, and its updates come from two places.

New

• Linux on Arm: a .deb, an .rpm and an AppImage for 64-bit Arm (aarch64), such as a Raspberry Pi 4 or 5 on a 64-bit system. They are built natively, on the same Ubuntu as the x86_64 packages, so they need the same glibc (2.35 or later). The Arm AppImage updates itself like the x86_64 one.
• A second home for updates: each release is also copied to download.waveflow.app. At launch QuickPlay reads GitHub's latest.json, then that copy, and keeps the newest version either offers. If one of them is unreachable, the other still delivers the update. When both have it, GitHub's package comes first, the copy's if GitHub's cannot be downloaded or does not check out. Each package is still verified against the release key, whichever host it came from.

Fixes

• --register from an AppImage wrote a desktop entry pointing at the AppImage's temporary mount under /tmp, which goes away when QuickPlay closes, so Open with stopped working after the first run. It now registers the .AppImage file itself. Run it again if you move that file.

Security

• An AppImage takes only its own architecture's update. The manifest that lists the packages is not signed, only each package is. An x86_64 package, genuinely signed, could therefore have been listed under the Arm entry. Each AppImage now accepts only a file whose signed name ends with its own architecture.

Install

• Windows: download waveflow-quickplay_1.5.0_x64-setup.exe. It installs for the current user without administrator rights and registers the context-menu entries. Run it over an earlier version to upgrade; your settings live in their own file and are kept.
• Linux, on x86_64 (amd64, x86_64 in the file name) or Arm (arm64, aarch64): the .deb for Debian and Ubuntu, the .rpm for Fedora, RHEL and openSUSE, or the .AppImage for any distribution (make it executable and run it). The .deb and the .rpm install the desktop entry, so QuickPlay appears in Open with for audio files and playlists. An AppImage installs nothing: run it once with --register for the same entry.
• macOS: download waveflow-quickplay_1.5.0_macos-universal.dmg, open it and drag WaveFlow QuickPlay to Applications. The app is signed ad hoc, not by an Apple Developer ID, so macOS blocks the first launch: open System Settings › Privacy & Security and choose Open Anyway (on macOS 14 and earlier, right-click the app and choose Open).

1.2.0 to 1.4.0, installed from the Windows installer, the macOS app or the x86_64 AppImage, update themselves to 1.5.0 from GitHub: they download it at launch and install it when you close QuickPlay. They know only GitHub; 1.5.0 is the first version that also reads the copy. 1.0.0 and 1.1.0 do not look for updates, so they are upgraded by hand once. Arm users install 1.5.0 by hand, since it is the first Arm release.

SHA-256 checksums are in SHA256SUMS-windows.txt, SHA256SUMS-linux.txt (x86_64), SHA256SUMS-linux-aarch64.txt and SHA256SUMS-macos.txt. latest.json is what the updater reads: it lists the packages that update themselves (the Windows installer, the macOS app and the two AppImages), each with its signature.

Note

The Windows installer is signed with WaveFlow's self-signed certificate, so Windows may still show a SmartScreen warning on first launch.

Known limitations

• The Arm packages were tested on GitHub's Arm build machines: built, installed and started there, not yet on a Raspberry Pi or another Arm desktop. Reports from Arm machines are welcome.
• An unreachable host delays the update by up to 30 seconds, the time the check gives each latest.json before going on to the other. It runs in the background: playback and the window are never held up.
• A .deb, an .rpm and a copy run from a read-only place (the disk image itself, or an app macOS runs from a translocated copy because it was not moved to Applications) are never replaced by QuickPlay: they only say that a new version is out.