Release CI: build a .deb package for Debian/Ubuntu/Mint (with declared CEF dependencies) #278

New issue

Closed

opened 2026-10-04 02:21:16 +00:00 by sky_line · 1 comment

sky_line commented

2026-10-04 02:21:16 +00:00

Owner

Build a .deb package in release CI, alongside the tarball, Windows installer/zip and Arch PKGBUILD (#248), so Debian/Ubuntu/Mint/Pop!_OS users can install with their package manager.

Why

Most Linux SL users are on Ubuntu-family distros (Mint, Pop!_OS, Ubuntu, Zorin, Debian).
A .deb gives a proper install: menu entry, secondlife:// handler, icons, uninstall, and declared dependencies. The dependencies matter most: the CEF/media plugin needs system libraries (nss, atk, cups, gbm, xkbcommon, asound, …) that the tarball can't pull in. Missing ones are the #245 / #264 "media_plugin_cef failed" class of bug.

Design

Package slipstream-viewer (or slipstream), arch amd64.
- Contents: install the tarball tree to /opt/slipstream/.
- Launcher wrapper symlink /usr/bin/slipstream → the slipstream script.
- .desktop file and x-scheme-handler/secondlife MIME registration in /usr/share/applications/.
- hicolor icons in /usr/share/icons/hicolor/ (the tarball already ships them, #248).
- .packaged-by marker so the wrapper skips its per-user desktop entry / URL registration / media library check, as the Arch package does.
Depends: the runtime libraries the viewer + CEF need: libc6 (>= 2.38), libstdc++6, libvulkan1, libnss3, libnspr4, libatk1.0-0 / libatk-bridge2.0-0, libcups2, libgbm1, libxkbcommon0, libxcomposite1, libxdamage1, libxrandr2, libasound2 (t64 variants on 24.04+: use alternatives like libasound2t64 | libasound2), libpango-1.0-0, libcairo2, libdbus-1-3, libpulse0, libgtk-3-0 (if CEF needs it), libxss1, etc.
- Derive the list from ldd on the binaries (dpkg-shlibdeps can generate it) and verify in clean ubuntu:24.04, debian:13 and linuxmint containers.
Version: from scripts/ci/version.sh, e.g. 1.0.0~beta4 for betas (~ sorts before release, so the final 1.0.0 upgrades cleanly) and 1.0.0 for releases.
Build: dpkg-deb --build --root-owner-group from a staging dir on the applejack builder. No full debhelper tree needed. Run lintian in CI as a warning-only check.
Sandbox: chrome-sandbox setuid handling. Decide whether the package sets it 4755 root (enables the CEF sandbox; ties into security audit item U-4) or leaves the no-sandbox default. Document the choice.
Glibc floor: the release binary needs glibc ≥ 2.38 / GLIBCXX 3.4.32. That excludes Ubuntu 22.04 / Debian 12. State the minimum (Ubuntu 24.04+, Debian 13+, Mint 22+) in Depends and on the website.

Distribution

Phase 1: attach Slipstream_<ver>_amd64.deb to each Forgejo release, with its SHA-256 in the release notes like the other assets. Website install page: "Ubuntu / Debian / Mint: download the .deb and open it, or sudo apt install ./Slipstream_*.deb" (apt resolves the dependencies).
Phase 2 (optional): a signed APT repository (apt.slipstreamviewer.org) so updates come through apt upgrade. That needs a GPG signing key and a static repo (reprepro/aptly) deployed like the website. Ties into release signing (security open item) and a future updater.

CI

A new job in .forgejo/workflows/release.yml after build (like arch-package), continue-on-error so it never blocks the main assets.
Secrets: none for phase 1. Phase 2 needs the repo signing key (handle per the CI token hardening notes: env only, never in argv).

Test

Install on clean Ubuntu 24.04 / Mint 22 / Debian 13 VMs or containers: apt pulls the dependencies, the menu entry and secondlife:// links work, and web/media works out of the box (no media_plugin_cef failure).
Upgrade from beta to release and uninstall cleanly.

Build a `.deb` package in release CI, alongside the tarball, Windows installer/zip and Arch PKGBUILD (#248), so Debian/Ubuntu/Mint/Pop!_OS users can install with their package manager. ## Why - Most Linux SL users are on Ubuntu-family distros (Mint, Pop!_OS, Ubuntu, Zorin, Debian). - A `.deb` gives a proper install: menu entry, `secondlife://` handler, icons, uninstall, and **declared dependencies**. The dependencies matter most: the CEF/media plugin needs system libraries (nss, atk, cups, gbm, xkbcommon, asound, …) that the tarball can't pull in. Missing ones are the #245 / #264 "media_plugin_cef failed" class of bug. ## Design - **Package** `slipstream-viewer` (or `slipstream`), arch `amd64`. - Contents: install the tarball tree to `/opt/slipstream/`. - Launcher wrapper symlink `/usr/bin/slipstream` → the `slipstream` script. - `.desktop` file and `x-scheme-handler/secondlife` MIME registration in `/usr/share/applications/`. - hicolor icons in `/usr/share/icons/hicolor/` (the tarball already ships them, #248). - `.packaged-by` marker so the wrapper skips its per-user desktop entry / URL registration / media library check, as the Arch package does. - **`Depends:`** the runtime libraries the viewer + CEF need: libc6 (>= 2.38), libstdc++6, libvulkan1, libnss3, libnspr4, libatk1.0-0 / libatk-bridge2.0-0, libcups2, libgbm1, libxkbcommon0, libxcomposite1, libxdamage1, libxrandr2, libasound2 (t64 variants on 24.04+: use alternatives like `libasound2t64 | libasound2`), libpango-1.0-0, libcairo2, libdbus-1-3, libpulse0, libgtk-3-0 (if CEF needs it), libxss1, etc. - Derive the list from `ldd` on the binaries (`dpkg-shlibdeps` can generate it) and verify in clean `ubuntu:24.04`, `debian:13` and `linuxmint` containers. - **Version:** from `scripts/ci/version.sh`, e.g. `1.0.0~beta4` for betas (`~` sorts before release, so the final `1.0.0` upgrades cleanly) and `1.0.0` for releases. - **Build:** `dpkg-deb --build --root-owner-group` from a staging dir on the applejack builder. No full debhelper tree needed. Run `lintian` in CI as a warning-only check. - **Sandbox:** `chrome-sandbox` setuid handling. Decide whether the package sets it 4755 root (enables the CEF sandbox; ties into security audit item U-4) or leaves the no-sandbox default. Document the choice. - **Glibc floor:** the release binary needs glibc ≥ 2.38 / GLIBCXX 3.4.32. That excludes Ubuntu 22.04 / Debian 12. State the minimum (Ubuntu 24.04+, Debian 13+, Mint 22+) in `Depends` and on the website. ## Distribution - **Phase 1:** attach `Slipstream_<ver>_amd64.deb` to each Forgejo release, with its SHA-256 in the release notes like the other assets. Website install page: "Ubuntu / Debian / Mint: download the .deb and open it, or `sudo apt install ./Slipstream_*.deb`" (apt resolves the dependencies). - **Phase 2 (optional):** a signed APT repository (`apt.slipstreamviewer.org`) so updates come through `apt upgrade`. That needs a GPG signing key and a static repo (reprepro/aptly) deployed like the website. Ties into release signing (security open item) and a future updater. ## CI - A new job in `.forgejo/workflows/release.yml` after `build` (like `arch-package`), `continue-on-error` so it never blocks the main assets. - Secrets: none for phase 1. Phase 2 needs the repo signing key (handle per the CI token hardening notes: env only, never in argv). ## Test - Install on clean Ubuntu 24.04 / Mint 22 / Debian 13 VMs or containers: apt pulls the dependencies, the menu entry and `secondlife://` links work, and **web/media works out of the box** (no `media_plugin_cef` failure). - Upgrade from beta to release and uninstall cleanly.

sky_line added the

platform

feature

labels

2026-10-04 02:21:16 +00:00

sky_line referenced this issue from a commit

2026-10-04 06:45:16 +00:00

Debian/Ubuntu/Mint .deb packaging: scripts/packaging/deb (#278)

sky_line referenced this issue from a commit

2026-10-04 06:45:16 +00:00

release CI: deb-package job attaches the .deb to each release (#278)

sky_line referenced this issue from a commit