Skip to content

Dendro 2.12.0 — Direct repository configuration support and AppImage runtime repair

Choose a tag to compare

View all tags
@xyasharx xyasharx released this 17 Oct 18:36
· 43 commits to main since this release
v2.12.0
cc6c0af
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Direct repository configuration support

Dendro can now add a third-party repository from a direct HTTPS .repo
configuration URL on a native Fedora RPM installation.

  • The configuration is downloaded as the desktop user, not as root.
  • Before authorization, Dendro bounds the response, requires UTF-8 text, and
    validates the direct HTTPS address.
  • The fixed Polkit helper independently validates the repository definition,
    permits only a narrow DNF5 repository-option allowlist, requires package
    signature verification, rejects duplicate repository IDs, and creates a new
    root-owned file atomically without overwriting an existing file.
  • Dendro does not run dnf, dnf5, a shell, or an arbitrary privileged command
    for repository addition.
  • A direct COPR repository-file URL is supported. A COPR owner/project value,
    local file path, and generic command are intentionally not accepted.

Repository-file addition and removal require the helper installed by the Fedora
RPM. They remain unavailable from the Flatpak, AppImage, source checkout, and
wheel installation. Flatpak continues to reject host-helper launch.

AppImage startup repair

The AppImage build now bundles the required native Qt XCB/XKB runtime library
closure and the corresponding package copyright notices. Release CI also runs
an offline Xvfb startup smoke test that verifies a real application window is
mapped.

Upgrade notes

  • On Fedora RPM installations, update Dendro normally through the configured
    repository after the COPR build for this tag succeeds.
  • To add a repository, open System Software Repositories and paste the
    direct HTTPS URL to the provider's .repo file.
  • Adding the same source again does not overwrite the existing generated file.
    Remove the existing test or obsolete repository before adding a replacement.
  • Confirm the normal Polkit prompt only after reviewing the repository provider
    and URL.

Validation

The GitHub release workflow builds the Python distributions and AppImage, then
runs the offline graphical AppImage smoke test. The subsequent COPR RPM build
runs the RPM test suite plus AppStream and desktop-file validation from the
spec file. Treat both pipelines as release gates before announcing the update.

Assets 7
Loading