ricercar 0.6.0

ricercar 0.6.0 is a hardening release: the network receiver no longer trusts what the LAN sends it, updates are signed, playback holds up better over the network, and the whole app can be used from the keyboard.

Downloads

Your system	File	Install
Debian 12+, Ubuntu 22.04+, Mint, Pop!_OS, Zorin, elementary	ricercar_0.6.0-1_amd64.deb / _arm64.deb	sudo apt install ./ricercar_*.deb
Fedora, openSUSE Tumbleweed / Leap 16, RHEL / Alma / Rocky 10+	ricercar-0.6.0-1.x86_64.rpm / .aarch64.rpm	sudo dnf install ./ricercar-*.rpm (zypper install on openSUSE)
Arch, Manjaro, EndeavourOS, CachyOS, Omarchy	ricercar-0.6.0-1-x86_64.pkg.tar.zst	sudo pacman -U ricercar-*.pkg.tar.zst
Any distribution (portable)	ricercar-0.6.0-x86_64.AppImage / -aarch64.AppImage	chmod +x ricercar-*.AppImage && ./ricercar-*.AppImage
Any distribution (plain binaries)	ricercar-0.6.0-linux-x86_64.tar.gz / -aarch64	unpack, run bin/ricercar

The packages need glibc 2.35 or newer. SHA256SUMS is now signed; verify a download with
minisign and the project key:

minisign -Vm SHA256SUMS -P RWSLPLWZ/M4/9X1orGjyBkKYA7BmzgxxI8dveJ8YVcSQVrOpjinxS9fV
sha256sum --check --ignore-missing SHA256SUMS

What's new

• Signed updates. Each release's SHA256SUMS is signed with the project's minisign key, whose public half is built into ricercar. The in-app updater checks the signature and the version it names before installing anything, and re-checks the package as root right before the package manager reads it.
• A safer network receiver.
  • Control points can only queue http(s) streams, or local files that are already in your library.
  • Album art is only served for library tracks.
  • Malformed or oversized requests are refused instead of crashing or stalling the receiver.
  • Event subscriptions must point back at the subscriber.
  • Discovery only answers the local network.
• Steadier playback.
  • The next track is opened ahead of time on a separate thread, so slow NAS or network sources no longer cause a dropout at track changes.
  • A damaged file ends with an error instead of silencing the player.
  • A network failure mid-track is reported, not taken for the end of the track.
  • Pausing on devices without hardware pause no longer skips a fraction of a second.
• Search one plugin at a time. The search scope switch lists each signed-in plugin after Everything and My library.
• Keyboard and screen readers.
  • Buttons, the seek bar and the volume slider are reachable with Tab and work with Space, Enter and the arrow keys.
  • Screen readers get roles and values.
• First run.
  • Without a file-picker portal, Add folder lets you type the path.
  • Startup errors are shown as a notification and written to the log.
• Clean shutdown. systemctl --user stop ricercar and closing the session save the queue and say goodbye on the network. ricercar --version works.
• Library safety.
  • A second music folder whose name starts like the first (Music and Music-hires) is no longer emptied from the index while it is unmounted.
  • Folders that can't be read during a scan keep their tracks.
  • A failed playlist save leaves the playlist as it was.
• Privacy. The settings file, which holds your scrobbling keys, is now readable by you only.
• Packages.
  • AppStream metadata, so software centres show ricercar.
  • PNG icons.
  • Third-party licences under /usr/share/licenses/ricercar/.
  • openSUSE-friendly .rpm dependencies.
  • Made with Slint attribution in About.
• Fixes.
  • Artist pages with many albums no longer scroll sideways.
  • Show-in-folder and playlist export no longer freeze the window, and export goes to your XDG music folder.

For plugin authors

• Plugins now start with a cleared environment. Only HOME, USER, LOGNAME, PATH, LANG, LANGUAGE, LC_*, TZ, XDG_*, TMPDIR, the proxy variables, SSL_CERT_FILE, SSL_CERT_DIR and DBUS_SESSION_BUS_ADDRESS are passed on.
• A plugin runs in its own process group, which is killed as a whole when it stops.
• retry_after is capped at one hour.
• The hub only offers strictly newer versions. The app asks again when a plugin's download host changes.

See docs/plugins.md.

For packagers

• Building from source now needs Rust 1.92.
• The release packages install /usr/share/ricercar/self-update, which allows in-place updates. Distribution packages should not ship it; RICERCAR_NO_SELF_UPDATE=1 also turns in-place updates off.

From 0.5.2, Update now in Settings → About installs this version. From 0.5.1 or older, install it by hand once.

Plugins are written by third parties and are not reviewed by the ricercar project. They run with your permissions: install only plugins you trust, and check that they respect the terms of the service they use.

From source: cargo build --release (see the README for per-distro dependencies).