v26.11.1

.github/workflows/electron.yml

@@ -293,14 +293,15 @@ jobs:
       - name: Install system dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libfuse2 flatpak flatpak-builder imagemagick
+          sudo apt-get install -y libfuse2
 
       - name: Install dependencies
         run: |
           npm ci
           npm install --force @rollup/rollup-linux-x64-gnu
           npm install --force @rollup/rollup-linux-arm64-gnu
           npm install --force @rollup/rollup-linux-arm-gnueabihf
+          node scripts/install-linux-sharp.cjs
 
       # Bundled plugins are counted as downloads in the plugin store, so a
       # build only fetches them when the pins change.
@@ -426,89 +427,6 @@ jobs:
           path: release/termix_linux_armv7l_portable.tar.gz
           retention-days: 30
 
-      - name: Add Flathub repository
-        run: |
-          sudo flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
-
-      - name: Install Flatpak runtime and SDK
-        run: |
-          sudo flatpak install -y flathub org.freedesktop.Platform//24.08
-          sudo flatpak install -y flathub org.freedesktop.Sdk//24.08
-          sudo flatpak install -y flathub org.electronjs.Electron2.BaseApp//24.08
-
-      - name: Get version for Flatpak
-        id: flatpak-version
-        run: |
-          VERSION="${{ inputs.version_override }}"
-          if [ -z "$VERSION" ]; then
-            VERSION=$(node -p "require('./package.json').version")
-          fi
-          RELEASE_DATE=$(date +%Y-%m-%d)
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "release_date=$RELEASE_DATE" >> $GITHUB_OUTPUT
-
-      - name: Prepare Flatpak files
-        run: |
-          VERSION="${{ steps.flatpak-version.outputs.version }}"
-          RELEASE_DATE="${{ steps.flatpak-version.outputs.release_date }}"
-
-          CHECKSUM_X64=$(sha256sum "release/termix_linux_x64_appimage.AppImage" | awk '{print $1}')
-          CHECKSUM_ARM64=$(sha256sum "release/termix_linux_arm64_appimage.AppImage" | awk '{print $1}')
-
-          mkdir -p flatpak-build
-          cp packaging/flatpak/com.karmaa.termix.yml flatpak-build/
-          cp packaging/flatpak/com.karmaa.termix.desktop flatpak-build/
-          cp packaging/flatpak/com.karmaa.termix.metainfo.xml flatpak-build/
-          cp public/icon.svg flatpak-build/com.karmaa.termix.svg
-          convert public/icon.png -resize 256x256 flatpak-build/icon-256.png
-          convert public/icon.png -resize 128x128 flatpak-build/icon-128.png
-
-          cd flatpak-build
-          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/vVERSION_PLACEHOLDER/termix_linux_x64_appimage.AppImage|file://$(realpath ../release/termix_linux_x64_appimage.AppImage)|g" com.karmaa.termix.yml
-          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/vVERSION_PLACEHOLDER/termix_linux_arm64_appimage.AppImage|file://$(realpath ../release/termix_linux_arm64_appimage.AppImage)|g" com.karmaa.termix.yml
-          sed -i "s/CHECKSUM_X64_PLACEHOLDER/$CHECKSUM_X64/g" com.karmaa.termix.yml
-          sed -i "s/CHECKSUM_ARM64_PLACEHOLDER/$CHECKSUM_ARM64/g" com.karmaa.termix.yml
-          sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" com.karmaa.termix.metainfo.xml
-          sed -i "s/DATE_PLACEHOLDER/$RELEASE_DATE/g" com.karmaa.termix.metainfo.xml
-
-      - name: Build Flatpak bundle
-        run: |
-          cd flatpak-build
-          flatpak-builder --repo=repo --force-clean --disable-rofiles-fuse build-dir com.karmaa.termix.yml
-
-          ARCH=$(uname -m)
-          if [ "$ARCH" = "x86_64" ]; then
-            FLATPAK_ARCH="x86_64"
-          elif [ "$ARCH" = "aarch64" ]; then
-            FLATPAK_ARCH="aarch64"
-          else
-            FLATPAK_ARCH="$ARCH"
-          fi
-
-          flatpak build-bundle repo ../release/termix_linux_flatpak.flatpak com.karmaa.termix --runtime-repo=https://flathub.org/repo/flathub.flatpakrepo
-
-      - name: Create flatpakref file
-        run: |
-          VERSION="${{ steps.flatpak-version.outputs.version }}"
-          cp packaging/flatpak/com.karmaa.termix.flatpakref release/
-          sed -i "s|VERSION_PLACEHOLDER|v${VERSION}|g" release/com.karmaa.termix.flatpakref
-
-      - name: Upload Flatpak bundle
-        uses: actions/upload-artifact@v7
-        if: hashFiles('release/termix_linux_flatpak.flatpak') != '' && inputs.artifact_destination != 'none'
-        with:
-          name: termix_linux_flatpak
-          path: release/termix_linux_flatpak.flatpak
-          retention-days: 30
-
-      - name: Upload Flatpakref
-        uses: actions/upload-artifact@v7
-        if: hashFiles('release/com.karmaa.termix.flatpakref') != '' && inputs.artifact_destination != 'none'
-        with:
-          name: termix_linux_flatpakref
-          path: release/com.karmaa.termix.flatpakref
-          retention-days: 30
-
       # Every official plugin, for installs without internet. No update files.
       - name: Build Linux x64 full packages
         if: inputs.artifact_destination != 'none'

.github/workflows/flatpak.yml

@@ -0,0 +1,112 @@
+name: Publish Flatpak
+
+# Builds the Flatpak from a release's portable tarballs and adds the bundles to
+# that release. Stable releases also replace the repo at flatpak.termix.site,
+# which is what `flatpak update` reads.
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: "Release tag to package, like v26.11.1"
+        required: true
+        type: string
+      publish:
+        description: "Replace the live Flatpak repo"
+        required: true
+        default: true
+        type: boolean
+  workflow_call:
+    inputs:
+      release_tag:
+        description: "Release tag to package"
+        required: true
+        type: string
+      publish:
+        description: "Replace the live Flatpak repo"
+        required: true
+        type: boolean
+
+env:
+  FLATPAK_REPO_URL: https://flatpak.termix.site
+
+jobs:
+  build:
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.release_tag }}
+          fetch-depth: 1
+
+      # A tag from before this workflow has no build script.
+      - name: Use the newest packaging files
+        env:
+          WORKFLOW_SHA: ${{ github.sha }}
+        run: |
+          git fetch --depth 1 origin "$WORKFLOW_SHA"
+          git checkout "$WORKFLOW_SHA" -- packaging/flatpak
+
+      - name: Install tools
+        run: |
+          sudo add-apt-repository -y ppa:flatpak/stable
+          sudo apt-get update
+          sudo apt-get install -y flatpak flatpak-builder imagemagick qemu-user-static
+          flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+
+      - name: Download release tarballs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.release_tag }}
+        run: |
+          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --dir tarballs \
+            --pattern termix_linux_x64_portable.tar.gz \
+            --pattern termix_linux_arm64_portable.tar.gz
+
+      - name: Import signing key
+        env:
+          FLATPAK_GPG_KEY: ${{ secrets.FLATPAK_GPG_KEY }}
+        run: |
+          export GNUPGHOME="$RUNNER_TEMP/gnupg"
+          mkdir -m 700 "$GNUPGHOME"
+          printf '%s' "$FLATPAK_GPG_KEY" | gpg --batch --import
+          echo "FLATPAK_GPG_HOME=$GNUPGHOME" >> "$GITHUB_ENV"
+          echo "FLATPAK_GPG_KEY_ID=$(gpg --list-keys --with-colons | awk -F: '/^fpr/ { print $10; exit }')" >> "$GITHUB_ENV"
+
+      - name: Build
+        env:
+          TAG: ${{ inputs.release_tag }}
+        run: |
+          bash packaging/flatpak/build-repo.sh "${TAG#v}" tarballs out
+          chmod -R a+rX out/site
+
+      - name: Add bundles to the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.release_tag }}
+        run: |
+          gh release upload "$TAG" out/*.flatpak out/com.karmaa.termix.flatpakref \
+            --repo "$GITHUB_REPOSITORY" --clobber
+
+      - name: Upload repo for Pages
+        if: inputs.publish
+        uses: actions/upload-pages-artifact@v5
+        with:
+          path: out/site
+
+  deploy:
+    needs: build
+    if: inputs.publish
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ env.FLATPAK_REPO_URL }}
+    steps:
+      - name: Deploy
+        uses: actions/deploy-pages@v5

.github/workflows/release.yml

@@ -543,6 +543,19 @@ jobs:
       source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.translate.outputs.sha || needs.prep.outputs.sha }}
     secrets: inherit
 
+  flatpak:
+    needs: [prep, electron-release]
+    if: ${{ always() && needs.electron-release.result == 'success' && needs.prep.outputs.mode != 'Dry run' }}
+    permissions:
+      contents: write
+      pages: write
+      id-token: write
+    uses: ./.github/workflows/flatpak.yml
+    with:
+      release_tag: ${{ needs.prep.outputs.release_tag }}
+      publish: ${{ needs.prep.outputs.channel == 'Stable' }}
+    secrets: inherit
+
   electron-submit:
     needs: [prep, merge-to-main, electron-release]
     if: ${{ always() && needs.electron-release.result == 'success' && needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' && needs.prep.outputs.mode != 'Skip submit' }}

CHANGELOG.md

@@ -1,5 +1,94 @@
 # Changelog
 
+## 26.11.1
+
+### Added
+
+- Plugins in the desktop app can drag files out to Explorer or Finder
+- Termix actions: plugins can declare what they do once, and it works from the API with permission checks, dry runs, run history and approvals
+- API keys can be limited to reading or running actions, when an admin makes them
+- A click on a host can open its host page, when a plugin offers one
+- Plugins can build pages of tiles you drag and resize, and add many copies of one dashboard card, each with its own settings
+- A plugin a newer release ships is downloaded on its own when your image does not have it, and tried again on the next start when offline
+- Plugins can decide who may connect to a host, so a host can need approved access before an SSH or remote desktop session opens
+- When more than one plugin flags a host, its row shows one status dot with every reason in its tooltip
+- Plugins that issue SSH certificates can save them on the SSH key login they were issued for
+- Cmd+B shows or hides the sidebar, and can be changed in keybindings
+- The macOS menu bar icon can be monochrome (the default), in color or hidden, from the Termix menu
+- Browser back and forward, and the mouse back and forward buttons, move between the tabs you used instead of leaving Termix
+- Closing a tab goes back to the tab you used before it
+- Admin setting to stop anyone saving passwords and keys on hosts and credentials. Termix asks for them when connecting (#1753)
+- A signed in user can prove a second factor again, for plugins that ask before something sensitive
+- Desktop app: a credential can be kept on this device only, and used as a personal login for a shared host or folder. It is never sent to the server (#1749)
+
+### Changed
+
+- Inputs, selects, tab groups and menus share one fill and one border color
+- Plugin cards and pages use the dashboard look everywhere, with shared lines between sections instead of separate boxes with gaps
+- The Plugins tab and plugin pages use the same look
+- List rows in plugins follow the host list status colors: accent for good, dark for offline or bad
+- Line charts that cover a few minutes show seconds in their times
+- Plugins a new release adds to the image start on only when they are recommended. The rest are installed and left off for an admin to turn on
+- Session tokens are stored as hashes, so a database copy holds no working logins (#1753)
+
+- Host status, import and export, and credential tools now start on for new installs
+- Sync now starts on in a new desktop app, so it can link to a server
+- The first run plugin picker leaves plugins you did not choose off instead of removing them
+- The Linux Flatpak now installs from flatpak.termix.site on x86_64 and arm64, and `flatpak update` keeps it current
+- Dropdowns and text areas are the same size as the text fields next to them
+- A page's own tabs sit above its search bar
+- A plugin view that is still starting shows the same loading spinner as the rest of Termix
+
+### Fixed
+
+- Exporting hosts keeps each host status check setting and interval (#1787)
+- A linked desktop app now updates a plugin that came with the app when the server has a newer copy (#1785)
+- The first run plugin picker no longer sets the default layout and themes to Remove. They always stay on
+- Alerts with no icon no longer squeeze their text to one word per line
+- Password fields with the show button are the same height as the other fields next to them
+- Button groups next to tabs no longer touch the lines of the tab row
+- The Secure your account setup step no longer shows up empty when no passkey or authenticator plugin is on
+- An installed plugin update older than the copy in a newer image is removed at startup instead of logging an error every boot
+- Canceling a download to the desktop app right as it starts no longer leaves a partial file behind
+- Changing two interface settings at once, like resetting the dashboard, now saves both instead of only the last one
+- Release notes on a plugin's page are no longer cut off on the left
+- The Community badge in Browse is no longer missing its top border
+- Official plugin pages no longer show a stray divider before the author
+- The version picker on a plugin's page is no longer empty for a plugin installed from a local build
+- The plugin video no longer has a second border around it
+- The hint at the bottom of Browse and the stored data footer on plugin pages have the same padding as the rest of the page
+- Sign in methods on the Security page have a line between them
+- Chart axis labels with long units, like KiB/s, are no longer cut off
+- Filters, view toggles and small buttons in a toolbar are the same height as the search box next to them
+- Save and Cancel at the bottom of a form are the same height as other buttons
+- State badges in tables no longer stretch across the whole column
+- Text boxes, dropdowns, checkboxes and button groups share one border color
+- Small icons in buttons sit centered instead of half a pixel off
+- Installing Termix as an app works behind a proxy that needs a login cookie
+- The hosts Import / Export button and menu entry show their name again instead of a text key
+- SSH logins to servers that only offer group exchange no longer stall for up to a minute while checking a large key exchange group
+- Plugin views can open the host editor again, so the terminal's Edit host button works after a failed connection
+- The Linux arm64 and armv7l desktop builds start again instead of failing to load the image library
+- The terminal offers to fill a saved sudo or SSH password at a password prompt again
+- Closing the desktop app on GNOME, like Fedora Workstation, quits it instead of minimizing, since GNOME has no tray to bring it back from
+- A deleted or changed host no longer stays in the host list when a list refresh was already running (#1782)
+- Plugin connections to a shared host are no longer reused between people, so each person connects with their own login
+- A session that still has to set up a second factor can no longer open terminals or other live connections
+- A login still waiting on its second factor can no longer be used for desktop sync
+- Someone with time limited manage access can no longer share a host or credential so it outlasts their own access
+- Changing your password signs out your other sessions before it answers
+- A host setting that needs a permission can no longer be changed through host import, bulk edits, host defaults or desktop sync without it
+- Requests sent with no body get a clear error instead of a server error
+- On PostgreSQL and MySQL, a link with an invalid id finds nothing instead of failing with a server error
+- On MySQL, a plugin update that stopped halfway through its database changes finishes on the next start
+- Plugin host settings no longer show the previous host's values for a moment after you switch hosts
+- Switching layouts closes the old layout's tabs again when you sign in
+- A plugin panel beside a tab that fails no longer blanks every open tab
+- Scrolling with the pointer over a row of tabs scrolls the page again
+- A host list refresh that finishes late no longer puts an older list back on screen
+- Switches in settings and the host editor are named for screen readers
+- The show password button and the sign in fields are translated
+
 ## 26.11.0
 
 ### Fixed