import-cert.sh wrote the decoded .p12 to a fixed name in the temp
directory. If another account had created that file first, the shell
redirection truncated and reused it, keeping its owner and mode, and the
signing key was readable to that account. Create it with mktemp.
Keep all 34 catalog deletions; sync crop options and fill rasterization text via craft-i18n 4a642c06dbcb8172f307f827c1167cd5dd8ac341. Adapt the fill prompt catalog test to embedded catalogs and preserve both parity-document updates.
Behaviour-preserving: `[[ ]]` in place of `[ ]` for bash tests (SonarCloud shell:S7688). Every script has a bash shebang; no test uses `-a`/`-o`, escaped parentheses or an unquoted pattern on the right of `=`. `bash -n` passes on each script; the rest is left to CI.
- `packaging/linux/apprun-cli-test.sh` (14)
Keeps the TSV deletions; pins craft-i18n 87f45ab (storytold/craft-i18n#216
head, now also carrying #11193's Move Toolbar rows) until #216 merges.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keeps the TSV deletions. The Hindi and RAW Develop catalog tests read the
embedded craft-i18n catalogs behind needs_catalogs(); display_names scans
CRAFT_I18N_DIR's locales/*/photocraft.tsv instead of the deleted src/i18n.
Pins craft-i18n 31d158f (storytold/craft-i18n#216 head, the #12403 top-up)
until #216 merges.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
COPY . . used to bring the in-repo catalogs; the builder now fetches the
pinned craft-i18n commit and builds with CRAFT_I18N_DIR and
CRAFT_I18N_REQUIRED=1, so the image is not English only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- `craft-i18n` crate (craft-libs c5a1cbfb, PhotoCraft's existing pin; already in the tree through
craft-ui) as a ui-egui dependency.
- build.rs writes `CRAFT_I18N` from `CRAFT_I18N_DIR`: one (locale, common.tsv, photocraft.tsv)
entry per locale with a PhotoCraft catalog, paths written with `{:?}` and never canonicalized.
Unset: empty, English only; `CRAFT_I18N_REQUIRED=1` makes a missing checkout an error.
- `craft-i18n.rev` pins storytold/craft-i18n 4bafe3ed (the cutover sync of photocraft@848fa30),
LF through `.gitattributes`.
- Both flatpak manifests fetch craft-i18n at that commit; the source build sets `CRAFT_I18N_DIR`
and `CRAFT_I18N_REQUIRED=1`. A test keeps both manifests equal to the pin.
- ci.yml: the Windows, without-heif and web jobs check out craft-i18n at the pin, as the shared
gate and release workflows do; a pin bump selects the web and Windows jobs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Main now installs NOTICE and ATTRIBUTION.md in the AppImage and in the source
Flatpak, and the Flatpak manifests start with a cups-client module. The test
copied a fixed list of files without them and ran the build commands of the first
module. Copy NOTICE and ATTRIBUTION.md into the fixture, and pick the photocraft
module by name.
Main now installs photocraft-cli, its man pages and shell completions, and the
NOTICE files in the Linux packages. Keep those and add what this branch still
provides: the CLI and the two offline automation guides (docs/mcp.md and
docs/control-protocol.md) in the source Flatpak manifest, and the guides in the
package staging directory.
* packaging: Flatpak finds and prints to CUPS printers
The Print dialog listed no printers in the Flatpak: the runtime has libcups but not
lpstat/lp, the sandbox couldn't reach the CUPS socket, and driverless network printers
(lpstat -e) need Avahi. Bundle lpstat/lp/lpoptions from CUPS 2.4.20 (Apache-2.0,
statically linked, licence installed) and grant --socket=cups and
--system-talk-name=org.freedesktop.Avahi in both manifests.
* print: lp takes the job only when CUPS lists a printer; the only printer by default; ~/.cups read-only
Review (CodeRabbit) on bundling lp in the Flatpak:
- With lp present but CUPS down or empty, the job failed on lp instead of reaching the
IPP route and the print portal. lp_route now gives up the route when lpstat lists no
printer, before anything is submitted.
- With no printer named, no default and one queue, IPP picked it but lp failed. lp_route
names the only printer.
- The sandbox ignored the user's default printer, saved options and client.conf server:
grant ~/.cups read-only in both manifests.
* print: no printers for lp means the portal, not IPP; bounded listing; CUPS socket wrapper
Review:
- When lp is there but CUPS lists no printer, the job went to the IPP route, whose
server detection ignores ~/.cups/client.conf and could print to a local default
printer instead of the configured server. It now goes to the print portal, or fails
with no portal.
- The lpstat listing before a job is bounded (10 s, then lp takes the job as before)
and runs outside SPOOLER, which guards only Windows driver calls.
- Flatpak mounts the host's CUPS socket at /var/run/cups/cups.sock whatever path
client.conf or CUPS_SERVER names; the CUPS tools now run through a wrapper that
points a socket path missing in the sandbox there, leaving server names alone.
* packaging: redirect a custom CUPS socket only when it is the one Flatpak mounted
Review (CodeRabbit): Flatpak picks the socket it mounts at /var/run/cups/cups.sock
with stricter rules than CUPS (flatpak-run-cups.c: a socket CUPS_SERVER, else the
first line spelled exactly "ServerName /path" in ~/.cups/client.conf, else the
default), while CUPS reads the keyword in any case and takes the last ServerName. The
wrapper now redirects only when CUPS' socket is the one Flatpak chose, so a job can't
reach a different server; otherwise CUPS fails on the missing path.
* print: a printer listing past its deadline kills and reaps lpstat
Review: the 10 s limit stopped waiting but left a hung lpstat and its thread
running, so repeated print attempts could pile them up. photocraft now runs the two
lpstat listings itself (craft-print's lpstat_command and an equivalent lpstat -e,
parsed by printers_parsed) and kills and reaps each one at the shared deadline. The
output is read on a thread that ends with the process, so nothing outlives the job.
* packaging: never redirect a CUPS_SERVER the sandbox was given
Review (CodeRabbit): Flatpak picks the socket it mounts from the host's CUPS_SERVER,
so one set by flatpak run --env or an override may not be what it mounted. The
wrapper now leaves any CUPS_SERVER alone and redirects only a client.conf socket that
matches Flatpak's choice; otherwise CUPS fails on the missing path instead of
reaching a different server.
* packaging: point CUPS at the mounted socket only when it is the one Flatpak chose, else fail
Review (CodeRabbit): with a custom socket listed first and the default last in
~/.cups/client.conf, Flatpak mounts the custom one at /var/run/cups/cups.sock while
CUPS picks the last line, finds that path, and talks to the custom server. The
wrapper now compares CUPS' socket with Flatpak's choice even when the path exists:
equal, CUPS is pointed at the mount; different, the tool fails with an error instead
of reaching another server.
Also (CodeRabbit):
- A printer named in the job goes to lp even when CUPS lists none: listing can be
forbidden while printing is not, and the portal can't honour a name.
- A failed lpstat -e (CUPS unreachable, listing forbidden) means the list can't be
told, so lp takes the job, instead of an empty list sending it to the portal.
- A listing longer than 1 MiB counts as no answer, instead of growing without bound.
- The kill test checks the process with kill -0, which works on every Unix.
- docs/printing.md: the only-printer fallback is on the lp and IPP routes, and the
portal is Linux only.
Adds Swedish (sv, Svenska) as an interface language. The catalog combines
the open Swedish catalogs of #5985 and #9536: each row takes the best of
their translations, with one Swedish term per concept across the UI and
the reference application's established Swedish terms where they are
unambiguous, and the strings added since are filled in. 4,537 rows, every
measured key; plural rule one|other.
Where the rows come from: 2,710 both catalogs agreed on, 979 from #5985,
655 from #9536, 193 written new; 177 of the taken rows
were edited for consistency.
The tests that used sv-SE as an unsupported locale now use sw-KE and
fi-FI, and sv-SE / sv_FI.UTF-8 are positive cases. macOS lists sv in
CFBundleLocalizations.
Fixes#10020.
Co-authored-by: kler <966132+kler@users.noreply.github.com>
Co-authored-by: davvarn <1687962+davvarn@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Honor CARGO_BUILD_TARGET in FreeBSD packaging for aarch64 release builds
package.sh took the arch from uname -m. The release VM is an x86_64 guest that
cross-compiles aarch64 with CARGO_BUILD_TARGET set, so an aarch64 build was
named freebsd-x86_64 and read binaries from the host target dir.
Read the arch from CARGO_BUILD_TARGET when it is set, and read binaries from
target/<triple>/release. Skip the man-page example and the --version run when
cross-building, since the aarch64 binaries cannot run on the x86_64 guest.
Unset CARGO_BUILD_TARGET keeps the old behavior.
* Reject unsupported CARGO_BUILD_TARGET and resolve host-tuple in FreeBSD packaging
Accept only x86_64-unknown-freebsd and aarch64-unknown-freebsd. Any other
target exits 2 before any build, so a non-FreeBSD target cannot be packaged
as an x86_64 FreeBSD archive.
Resolve cargo's host-tuple alias to the real host triple before choosing the
binary dir, so the path matches cargo's output.
* Skip the photocraft-cli --version run when CARGO_BUILD_TARGET is set
A target build's binary may not run on the host (aarch64 on the x86_64 VM),
and under set -e the smoke run would fail the release after the archive is
written. The native path (CARGO_BUILD_TARGET unset) still runs it.
Reapply Linux Adwaita no-title winit feature and its lockfile,
keep integrated title bar as default, and port compatible tests/docs.
Preserve upstream's preferences UI refactor rather than restoring
its removed prefs_ui.rs file.
The policy check now reads the compiled AppSearch and RegLocator rows for the
remembered-folder properties (registry root, key, value name and type for both
scopes) and runs the DIR, FOLDER, PATH and legacy exe actions in sequence order
against seeded values, so their precedence and the preset-folder guard cannot
regress. It also replays the wizard folder actions in sequence order (a
remembered folder beats the new-install default, a typed folder beats both) and
requires the machine restore action between the scope page and costing.
The pre-signing check matched any folder named Program Files, so it rejected
a valid MSI when Windows resolves Program Files elsewhere, accepted the 64-bit
root for an x86 package and accepted a different app name. Build the expected
folder from the package architecture's resolved root and the policy name.
Real msiexec runs (per-user and all-users, silent and wizard) found two defects
that the metadata fixtures cannot see:
- "Only for me" published ALLUSERS=2, so FindRelatedProducts treated the run as
per-machine and skipped the existing per-user copy. An interactive upgrade
left two registered products and uninstall left files behind. The page now
leaves ALLUSERS unset for a per-user choice.
- Windows Installer resolves Program Files once, for the context it started in,
so choosing "Everyone" in the wizard installed into the user profile with a
machine-wide registration. The wizard now sets the new-install folder itself
after the choice (Program Files, Program Files (x86) for 32-bit, or the
per-user Programs folder). Silent installs are unchanged.
check-install-policy.ps1 now fails if either regresses.
Microsoft "Single Package Authoring": Package/Scope="perUserOrMachine"
writes ALLUSERS=2 and MSIINSTALLPERUSER=1, so the package installs
per-user by default (no UAC prompt) into %LOCALAPPDATA%\Programs\ArtCraftPhotoCraft (Windows Installer redirects the ProgramFiles folder in a
per-user install), and per-machine into Program Files\ArtCraft\PhotoCraft
through the setup wizard's "Install for all users" box or msiexec
ALLUSERS=1. Registry follows the context automatically: HKMU writes HKCU
per-user and HKLM per-machine, HKCR classes land in HKCU\Software\Classes
per-user, and components are keyed on registry values (ICE38).
Upgrades update the copy registered in the same context: the remembered
InstallDir is read from HKLM and HKCU separately, and installing in the
other context while a copy already exists is stopped with a message naming
the fix rather than creating a silent duplicate. The existing UpgradeCode,
ProductCode behaviour and per-machine upgrades are unchanged.
The Start Menu shortcut becomes non-advertised in its own component (an
advertised shortcut must target its component keypath, which is now a
registry value), as the ArtCraft Launcher's MSI already does.
Built and checked with WiX 5.0.2: full ICE validation and ICE50 pass, and
the built package's Property table, launch conditions, directory chain and
registry roots were read back from the MSI.
- Remove blank lines between doc comments or #[test] attributes and the item (S8855, S8856)
- type_tool: drop the redundant else after continue in the IME event arm (S8862)
- ui_state: pass OsStr::to_os_string instead of an equivalent closure (S1612)
- macos packaging: [[ ]] for the attempt test (S7688); bind validate_staple's argument to a local (S7679)
* egui037: name each control for what it sets, and order the eager fonts for the UI
CodeRabbit review follow-ups on the migration: the Artboard X/Y fields, the CAF
dropdowns, the channel Solidity field, the GPU backend/adapter dropdowns, the
corner radius fields and the canvas extension colour all had an accessible name
that named another control (or was shared by four). The eager craft-fonts
registration now puts the UI Japanese face first, as the lazy loader does, so
Japanese UI is not drawn in the manifest's Mincho face and shared Han characters
do not take Japanese forms.
Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
* egui037: rustfmt the eager craft-font order
---------
Co-authored-by: Dylan M. Taylor <dylan@dylanmtaylor.com>
Co-authored-by: Codebuff <noreply@codebuff.com>
sign.ps1 downloaded Microsoft.Trusted.Signing.Client from the unversioned
NuGet URL and loaded its dlib into signtool, next to the Azure signing
secrets, with no version or integrity check.
Download a pinned version (1.0.95, which the unversioned URL serves today)
and refuse it unless its SHA-256 matches, so upgrading the client is a
deliberate change in the repository. The release docs say where the pin
lives.
Prebuilt binaries packaged with --skip-build failed when the example
wasn't built with them. The package now leaves photocraft-cli's man pages
and completions out with a warning, as a cross build without an emulator
does.
Dylan M. Taylor
Tanish Manku
skylar taylor-barrick
Martin BallandClaude Opus 5.5
haranishi
Brandon ThomasandClaude Opus 5.5
FredApps
aiongg
FredApps
Daniel
Jeremy
Erica Franco
aiongg