Platform Notes

Platform Notes

Build matrix

Target	Runner	Output
macOS 12+	macos-latest	.dmg, .app
Windows 10/11	windows-latest	.msi, .exe (NSIS)
Debian 12+ / Ubuntu 22.04+	ubuntu-22.04	.deb
Fedora 38+ / RHEL 9.4+	Fedora/RHEL 9 container	.rpm

The Linux glibc floor is set by the build runner, not by our code. A binary built on Ubuntu 24.04 will not run on Debian 12. This is why CI pins ubuntu-22.04 for .deb and uses a RHEL 9-era container for .rpm.

Flume's TLS choice helps here: because we build librqbit with rust-tls instead of native TLS, packages carry no libssl runtime dependency, which removes the most common cross-distro breakage.

macOS

Minimum: 12.0 (set in tauri.conf.json).

WebView: WKWebView, bundled with the OS. No runtime to ship.

Unsigned builds are blocked by Gatekeeper. Users can bypass via right-click → Open, or:

xattr -dr com.apple.quarantine /Applications/Flume.app

Signing requires an Apple Developer account ($99/yr), a Developer ID Application certificate, and notarization through Apple's service. Tracked in #18.

Universal binaries (--target universal-apple-darwin) roughly double bundle size. Decision deferred.

Windows

Minimum: Windows 10 1803.

WebView: WebView2, preinstalled on Windows 11 and current Windows 10. Tauri can bundle a bootstrapper for older systems.

SmartScreen warns on unsigned executables until a download reputation builds. Code signing certificates cost real money annually; EV certificates clear SmartScreen immediately, OV ones build reputation over time.

Known issue — file locking and seeding. Windows lets a process hold an exclusive handle to a file, which can block seeding while another application has the file open. A community client ("Drift") patched librqbit's storage layer for this.

Unverified on librqbit v9. Tracked in #9. Confirm reproduction before patching or vendoring.

Linux

WebView: WebKitGTK 4.1. This is the single biggest source of rendering differences from macOS and Windows — it lags on newer CSS features. Test layout changes on Linux early rather than late.

Debian / Ubuntu

sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev \
  librsvg2-dev patchelf build-essential curl wget file libxdo-dev libssl-dev

Fedora / RHEL / Rocky / Alma

sudo dnf install -y webkit2gtk4.1-devel openssl-devel curl wget file \
  libappindicator-gtk3-devel librsvg2-devel gcc gcc-c++ make

RHEL 9 derivatives may need EPEL for libappindicator-gtk3-devel. Verify webkit2gtk4.1 availability on the exact base image before relying on it.

Wayland

Tauri runs under Wayland via GTK. If rendering misbehaves, force X11:

GDK_BACKEND=x11 flume

AppImage

Optional additional output. Bundles more dependencies, so it works across more distros at the cost of size.

Sandboxing and firewalls

Flume needs:

• Outbound TCP to peers and trackers
• Outbound UDP for DHT
• Inbound TCP on the listen port (42221) for incoming peers and seeding
• Outbound UDP to the gateway for UPnP port mapping, if enabled

macOS prompts for incoming connections on first launch. Linux firewalls (ufw, firewalld) usually need an explicit rule for inbound.

Per-platform smoke checklist

Run before tagging a release:

• Window opens and renders correctly
• Engine reaches Ready within ~10s
• Listen port binds; verify in status
• Add a magnet (a Linux ISO) and confirm metadata resolves
• Download completes and file integrity verifies
• Seeding works with another client connected
• Quit and relaunch; torrent resumes without full re-hash
• Open containing folder works
• Theme matches system setting