Skip to content

Klipa Player 0.1.1 (Linux amd64)

Latest
Latest

Choose a tag to compare

View all tags
@KlipaTV KlipaTV released this 10 Sep 21:18
v0.1.1
491d3f9

Klipa Player 0.1.1 for Linux (amd64)

First tagged Linux release: klipa-player_0.1.1-1_amd64.deb, built from tag v0.1.1 (commit 491d3f9).

Klipa is a local-first player for the M3U or Xtream playlist you already own. It includes,
hosts, indexes and suggests no source of streams. No account, no sign-in: playlists,
favourites and settings stay on your device. Every outbound request the app can make is
enumerated at https://klipa.tv/privacy/ — if you find one that is not there, tell me.

What this supersedes

This replaces the untagged 0.1.0 build published on 2026-07-16. That artifact could not be
attributed to a source revision, which is why it was never released here. This build is
traceable to the tag above, and its checksum is different:

artifact sha256
superseded klipa-player_0.1.0-1_amd64.deb (2026-07-16) 2fc76f633f34187e23794969d383e135248430e62f0294918587c7a9234e5d6c
this release klipa-player_0.1.1-1_amd64.deb d9ce557bcbc4908c858a7cfc1039aadf5d934cc4aecfee1e34333b734a9a3f51

If you downloaded the 0.1.0 file from klipa.tv, its checksum no longer appears in
SHA256SUMS.txt; download this build instead.

How it was validated

  • dart format --set-exit-if-changed (55 files, 0 changed), flutter analyze --fatal-infos --fatal-warnings (clean), flutter test (139 passed, 3 skipped — Windows-only).
  • flutter build linux --release, packaged with tool/package_linux.sh.
  • Deterministic parser fuzz: 20,000 M3U/XMLTV mutations plus 1,000 Xtream inputs, no failures.
  • Install / start (5 s, zero TCP connections) / uninstall smoke test, run by the maintainer
    as root in a disposable container — not on a developer machine, which is why the gate is
    reported as passed only for this artifact.

Known gaps, stated plainly

  • No vulnerability scan. The documented grype high/critical advisory scan did not run:
    grype is not installed on the build host. Not claimed as passing.
  • THIRD_PARTY_NOTICES.md is carried over unchanged. Its 14 direct-dependency rows match
    pubspec.yaml exactly and no dependency changed, so it remains accurate — but its documented
    generator needs Windows tooling (a Windows bundle, PowerShell, wslpath), so there is no
    Linux regenerator     for the notices file yet. Known gap.
  • The .deb is not byte-reproducible yet. Two builds differ: dpkg-deb embeds file mtimes
    and the packager sets no SOURCE_DATE_EPOCH. A follow-up PR will normalise the staging tree
    mtimes, pin SOURCE_DATE_EPOCH and fix the zstd flags, verified by two identical rebuilds.
    The sha256 of this artifact (d9ce557b…) is the one to check against.
  • Windows is not in this release. The Windows build path exists but its signing
    subscription is not set up yet; nothing is published unsigned.
  • Not validated here: clean-VM install/upgrade matrices and the Intel/AMD/NVIDIA media
    matrix — no such hardware on the build host.

Assets

  • klipa-player_0.1.1-1_amd64.deb — the package (Debian/Ubuntu, amd64)
  • SHA256SUMS.txt — checksum for the package
  • THIRD_PARTY_NOTICES.md — third-party notices
  • sbom-source.cdx.json — CycloneDX SBOM of the source

Report bugs rather than stars: tell me your device and how your playlist is structured.

Assets 6
Loading