urnetwork
diff --git a/‎app/packaging/network.ur.urnetwork.metainfo.xml‎
Lines changed: 85 additions & 0 deletions b/‎app/packaging/network.ur.urnetwork.metainfo.xml‎
Lines changed: 85 additions & 0 deletions
diff --git a/‎packaging/flatpak/network.ur.urnetwork.yml‎
Lines changed: 186 additions & 0 deletions b/‎packaging/flatpak/network.ur.urnetwork.yml‎
Lines changed: 186 additions & 0 deletions
diff --git a/‎packaging/make-flatpak.sh‎
Lines changed: 91 additions & 0 deletions b/‎packaging/make-flatpak.sh‎
Lines changed: 91 additions & 0 deletions
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  AppStream metadata. Required by Flathub, and read by GNOME Software / KDE
+  Discover for every other channel too. The component id MUST equal the .desktop
+  basename and the GTK application id in src/main.cpp (network.ur.urnetwork) or
+  the store shows a nameless entry and D-Bus activation misses.
+
+  project_license is the CODE license (MPL-2.0). The four commercial brand
+  faces under assets/fonts are separately licensed and NOT MPL — they are
+  declared here as a non-free content attribute rather than folded into the
+  project license, because claiming MPL over them would be false.
+
+  SPDX-License-Identifier: MPL-2.0
+-->
+<component type="desktop-application">
+  <id>network.ur.urnetwork</id>
+
+  <name>URnetwork</name>
+  <summary>Private, decentralized VPN powered by a peer network</summary>
+
+  <metadata_license>CC0-1.0</metadata_license>
+  <project_license>MPL-2.0</project_license>
+
+  <developer id="ur.io">
+    <name>URnetwork</name>
+  </developer>
+
+  <description>
+    <p>
+      URnetwork routes your traffic through a decentralized network of peers
+      instead of a single provider's servers. Choose a country or let the app
+      pick the best available provider, and connect.
+    </p>
+    <p>
+      Provide bandwidth back to the network and earn payouts in USDC. Track
+      what you have provided, what you are owed, and where your network ranks.
+    </p>
+    <p>
+      This Flatpak ships the graphical client only. Connecting requires the
+      URnetwork system service, which must be installed from your
+      distribution's native package: a sandboxed application cannot create a
+      tunnel device or enforce a kill switch. The app talks to that service
+      over a local socket and tells you plainly when it is missing or out of
+      date.
+    </p>
+  </description>
+
+  <launchable type="desktop-id">network.ur.urnetwork.desktop</launchable>
+
+  <url type="homepage">https://ur.io</url>
+  <url type="bugtracker">https://github.com/urnetwork/urnetwork-linux/issues</url>
+  <url type="help">https://ur.xyz</url>
+
+  <categories>
+    <category>Network</category>
+    <category>Security</category>
+  </categories>
+
+  <keywords>
+    <keyword>VPN</keyword>
+    <keyword>privacy</keyword>
+    <keyword>proxy</keyword>
+    <keyword>decentralized</keyword>
+  </keywords>
+
+  <supports>
+    <control>pointing</control>
+    <control>keyboard</control>
+    <control>touch</control>
+  </supports>
+
+  <requires>
+    <display_length compare="ge">480</display_length>
+  </requires>
+
+  <content_rating type="oars-1.1"/>
+
+  <releases>
+    <release version="0.0.1" date="2026-08-14">
+      <description>
+        <p>First Linux release of the GTK4 client.</p>
+      </description>
+    </release>
+  </releases>
+</component>
@@ -0,0 +1,186 @@
+# URnetwork — Flatpak manifest (GUI ONLY).
+#
+# WHY GUI-ONLY (docs/linux_agent_help.md §10.1/§10.2, and it is not a
+# limitation we chose): a Flatpak sandbox has no /dev/net/tun, no
+# CAP_NET_ADMIN, and no way to install a system unit. No official VPN with a
+# kill switch ships its daemon in a Flatpak — Mozilla VPN, the one on Flathub,
+# DELETED its privileged daemon and drives NetworkManager over D-Bus instead,
+# forfeiting split tunneling. That trade contradicts this product's
+# leak-prevention requirements, so it is not taken.
+#
+# Instead this follows the Trayscale pattern: the GUI runs sandboxed and
+# reaches the host's urnetworkd over its Unix control socket, exposed with
+# --filesystem=/run/urnetwork:ro. Read-only is correct AND sufficient:
+# connect(2) on a unix socket is not a filesystem write, and Linux exempts
+# sockets from the read-only-mount EROFS check (only REG/DIR/LNK are covered).
+# The daemon itself comes from the host's native .deb/.rpm.
+#
+# The app already renders the missing-daemon case as a distinct, actionable
+# state (MainWindow::StartTunnelUi: "service not running" / "service out of
+# date" / "app out of date" / "builds differ"), so a Flatpak with no host
+# daemon explains itself instead of failing blank.
+#
+# LOCAL INSTALL (the current target — Flathub submission comes later):
+#   flatpak install -y flathub org.gnome.Platform//49 org.gnome.Sdk//49
+#   flatpak run org.flatpak.Builder --force-clean --user --install \
+#     build-flatpak packaging/flatpak/network.ur.urnetwork.yml
+#   flatpak run network.ur.urnetwork
+#
+# FOR FLATHUB, two changes are required and are deliberately NOT made here:
+#   1. `sources: [{type: dir, path: ../..}]` must become a git/archive source
+#      with a commit or sha256 — Flathub forbids local directory sources.
+#   2. The four commercial brand faces under app/assets/fonts are NOT MPL-2.0.
+#      Flathub requires the licenses of every bundled binary asset to permit
+#      redistribution; that audit (§7.17) must land before submission.
+#
+# SPDX-License-Identifier: MPL-2.0
+id: network.ur.urnetwork
+runtime: org.gnome.Platform
+runtime-version: '49'
+sdk: org.gnome.Sdk
+command: urnetwork-gui
+
+finish-args:
+  # Display. Wayland first (this is a Wayland-native GTK4 app); X11 fallback
+  # for the sessions that still need it.
+  - --socket=wayland
+  - --socket=fallback-x11
+  - --share=ipc
+  - --device=dri
+
+  # The SDK talks to the URnetwork API over the internet, and the GUI reaches
+  # the daemon's loopback mTLS device RPC on 127.0.0.1. Both need the host
+  # network namespace.
+  - --share=network
+
+  # THE HOST DAEMON'S CONTROL SOCKET. Without this the app runs, shows the
+  # login screen, and reports "service not running" — it never silently fails.
+  - --filesystem=/run/urnetwork:ro
+
+  # The SNI tray (Tray.cpp speaks StatusNotifier over raw GDBus). Only the
+  # WATCHER is declared: flatpak's name policy can grant a dotted subtree but
+  # not the hyphenated org.kde.StatusNotifierItem-<pid>-<id>, so no --own-name
+  # can match it (flatpak rejects the manifest outright if you try). Tray.cpp
+  # handles this by falling back to registering under the connection's unique
+  # bus name, which the SNI spec allows and which needs no ownership.
+  - --talk-name=org.kde.StatusNotifierWatcher
+
+  # Opening sign-in / wallet-connect / support links in the user's browser.
+  - --talk-name=org.freedesktop.portal.OpenURI
+
+  # Autostart is requested through the Background portal — the sandboxed
+  # equivalent of the ~/.config/autostart symlink the native build writes.
+  - --talk-name=org.freedesktop.portal.Background
+
+  # GeoClue: the app can pin the device's reported location to the connected
+  # provider. Optional — a refused permission costs the override, nothing else.
+  - --system-talk-name=org.freedesktop.GeoClue2
+
+cleanup:
+  - /include
+  - /lib/pkgconfig
+  - /lib/cmake
+  - /share/pkgconfig
+  - /share/aclocal
+  - /share/devhelp
+  - /share/doc
+  - /share/man
+  - '*.a'
+  - '*.la'
+
+modules:
+  # ---- the gtkmm stack --------------------------------------------------
+  # org.gnome.Sdk 49 carries GTK 4.20 and libadwaita 1.8 but NO C++ bindings,
+  # so the five -mm libraries are built here. Versions are pinned to the ones
+  # that pair with the runtime's C libraries (glib 2.86, cairo 1.18, pango
+  # 1.57, GTK 4.20) — do not bump one without the others.
+  - name: libsigc++
+    buildsystem: meson
+    config-opts:
+      - -Dbuild-documentation=false
+      - -Dbuild-examples=false
+    sources:
+      - type: archive
+        url: https://download.gnome.org/sources/libsigc++/3.6/libsigc++-3.6.0.tar.xz
+        sha256: c3d23b37dfd6e39f2e09f091b77b1541fbfa17c4f0b6bf5c89baef7229080e17
+
+  - name: glibmm
+    buildsystem: meson
+    config-opts:
+      - -Dbuild-documentation=false
+      - -Dbuild-examples=false
+    sources:
+      - type: archive
+        url: https://download.gnome.org/sources/glibmm/2.86/glibmm-2.86.0.tar.xz
+        sha256: 39c0e9f6da046d679390774efdb9ad564436236736dc2f7825e614b2d4087826
+
+  # cairomm 1.16+ is released by cairographics.org, NOT download.gnome.org
+  # (the GNOME mirror stops at the old 1.12/1.15 API series).
+  - name: cairomm
+    buildsystem: meson
+    config-opts:
+      - -Dbuild-documentation=false
+      - -Dbuild-examples=false
+      - -Dbuild-tests=false
+    sources:
+      - type: archive
+        url: https://www.cairographics.org/releases/cairomm-1.18.0.tar.xz
+        sha256: b81255394e3ea8e8aa887276d22afa8985fc8daef60692eb2407d23049f03cfb
+
+  - name: pangomm
+    buildsystem: meson
+    config-opts:
+      - -Dbuild-documentation=false
+    sources:
+      - type: archive
+        url: https://download.gnome.org/sources/pangomm/2.56/pangomm-2.56.2.tar.xz
+        sha256: f1e984c85a85b6a0e61616366521f51dd8282a072bb45d15b5084762b62f4c0e
+
+  - name: gtkmm
+    buildsystem: meson
+    config-opts:
+      - -Dbuild-documentation=false
+      - -Dbuild-demos=false
+      - -Dbuild-tests=false
+    sources:
+      - type: archive
+        url: https://download.gnome.org/sources/gtkmm/4.20/gtkmm-4.20.0.tar.xz
+        sha256: daad9bf9b70f90975f91781fc7a656c923a91374261f576c883cd3aebd59c833
+
+  # ---- nlohmann_json (header-only) --------------------------------------
+  - name: nlohmann-json
+    buildsystem: cmake-ninja
+    config-opts:
+      - -DJSON_BuildTests=OFF
+    sources:
+      - type: archive
+        url: https://github.com/nlohmann/json/archive/refs/tags/v3.12.0.tar.gz
+        sha256: 4b92eb0c06d10683f7447ce9406cb97cd4b453be18d7279320f7b2f025c10187
+
+  # ---- the app ----------------------------------------------------------
+  - name: urnetwork
+    buildsystem: meson
+    subdir: app
+    config-opts:
+      - -Dgui=enabled
+      # Drops urnetworkd and the four host-integration files that install to
+      # ABSOLUTE paths (/lib/systemd/system, /etc/urnetwork, /etc/NetworkManager,
+      # /etc/udev) — nothing outside /app is writable in a Flatpak build, so
+      # without this the install step fails outright. It also relocates the
+      # vendored SDK to the libdir root, where the GUI's own rpath
+      # ($ORIGIN/../lib) finds it.
+      - -Dhost_integration=false
+    post-install:
+      # The installed .desktop points Exec at /usr/bin/urnetwork, the daemon
+      # package's launcher that finds and execs the user's AppImage. There is
+      # no AppImage here and no /usr/bin to put a launcher in, so the Flatpak
+      # runs the GUI binary directly.
+      - desktop-file-edit --set-key=Exec --set-value="urnetwork-gui %u"
+        /app/share/applications/network.ur.urnetwork.desktop
+      - desktop-file-edit --remove-key=TryExec
+        /app/share/applications/network.ur.urnetwork.desktop
+    sources:
+      # LOCAL SOURCE — replace with a git/archive source before any Flathub
+      # submission (see the header). The path is relative to this manifest.
+      - type: dir
+        path: ../..
@@ -0,0 +1,91 @@
+#!/bin/bash
+# Build (and optionally install) the URnetwork Flatpak — the GUI-only artifact.
+#
+# The daemon is NOT in here and cannot be: a Flatpak sandbox has no
+# /dev/net/tun, no CAP_NET_ADMIN and no way to install a system unit. The app
+# reaches the HOST's urnetworkd over /run/urnetwork/control.sock, which the
+# manifest exposes read-only (Trayscale's pattern). Install the daemon from the
+# native .deb/.rpm — see packaging/flatpak/network.ur.urnetwork.yml for the
+# full reasoning.
+#
+# Works on an immutable host (Bazzite/Silverblue): flatpak-builder itself runs
+# as a flatpak (org.flatpak.Builder), so nothing is layered onto /usr.
+#
+#   ./packaging/make-flatpak.sh                 # build only
+#   ./packaging/make-flatpak.sh --install       # build + install --user
+#   ./packaging/make-flatpak.sh --install --run # ...and launch it
+#   ./packaging/make-flatpak.sh --bundle        # build + export a .flatpak file
+#
+# SPDX-License-Identifier: MPL-2.0
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+MANIFEST="${MANIFEST:-$REPO_ROOT/packaging/flatpak/network.ur.urnetwork.yml}"
+APP_ID="network.ur.urnetwork"
+RUNTIME_VERSION="${RUNTIME_VERSION:-49}"
+# The build dir MUST live inside the repo. flatpak-builder runs sandboxed and
+# gets a PRIVATE /tmp, so a build dir under the host's /tmp vanishes between
+# stages ("Build directory not initialized, use flatpak build-init").
+BUILD_DIR="${BUILD_DIR:-$REPO_ROOT/build-flatpak}"
+OUT_DIR="${OUT_DIR:-$REPO_ROOT/out}"
+
+DO_INSTALL=0
+DO_RUN=0
+DO_BUNDLE=0
+for arg in "$@"; do
+  case "$arg" in
+    --install) DO_INSTALL=1 ;;
+    --run)     DO_INSTALL=1; DO_RUN=1 ;;
+    --bundle)  DO_BUNDLE=1 ;;
+    *) echo "unknown argument: $arg" >&2; exit 2 ;;
+  esac
+done
+
+command -v flatpak >/dev/null || { echo "flatpak is not installed" >&2; exit 1; }
+[[ -f "$MANIFEST" ]] || { echo "manifest not found: $MANIFEST" >&2; exit 1; }
+
+# flatpak-builder: prefer a native one, fall back to the flatpak'd builder
+# (the only option on an immutable host).
+if command -v flatpak-builder >/dev/null; then
+  BUILDER=(flatpak-builder)
+else
+  if ! flatpak info org.flatpak.Builder >/dev/null 2>&1; then
+    echo "installing org.flatpak.Builder (no native flatpak-builder found)"
+    flatpak install -y --noninteractive flathub org.flatpak.Builder
+  fi
+  BUILDER=(flatpak run org.flatpak.Builder)
+fi
+
+echo "==> ensuring runtime + sdk ${RUNTIME_VERSION}"
+flatpak install -y --noninteractive flathub \
+  "org.gnome.Platform//${RUNTIME_VERSION}" "org.gnome.Sdk//${RUNTIME_VERSION}" >/dev/null
+
+# --disable-rofiles-fuse: rofiles-fuse needs FUSE inside the builder sandbox,
+# which is not reliably available on an immutable host. It only costs build
+# isolation, not correctness.
+BUILD_ARGS=(--force-clean --disable-rofiles-fuse)
+[[ "$DO_INSTALL" == 1 ]] && BUILD_ARGS+=(--user --install)
+if [[ "$DO_BUNDLE" == 1 ]]; then
+  mkdir -p "$OUT_DIR"
+  BUILD_ARGS+=(--repo="$BUILD_DIR-repo")
+fi
+
+echo "==> building $APP_ID"
+( cd "$REPO_ROOT" && "${BUILDER[@]}" "${BUILD_ARGS[@]}" "$BUILD_DIR" "$MANIFEST" )
+
+if [[ "$DO_BUNDLE" == 1 ]]; then
+  VERSION="${VERSION:-0.0.0-dev}"
+  BUNDLE="$OUT_DIR/URnetwork-${VERSION}.flatpak"
+  echo "==> exporting $BUNDLE"
+  flatpak build-bundle "$BUILD_DIR-repo" "$BUNDLE" "$APP_ID" \
+    --runtime-repo=https://flathub.org/repo/flathub.flatpakrepo
+  echo "built: $BUNDLE"
+fi
+
+if [[ "$DO_INSTALL" == 1 ]]; then
+  echo "==> installed. The GUI needs the HOST daemon to connect:"
+  echo "    sudo systemctl status urnetworkd    # install it from the .deb/.rpm"
+fi
+
+[[ "$DO_RUN" == 1 ]] && exec flatpak run "$APP_ID"
+exit 0