From 07304ce657365cf2429555fe846b5ab1954e1258 Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Fri, 6 Nov 2026 22:12:33 -0300 Subject: [PATCH 1/6] recipes: move overrides back above Wolfi's newer builds task lock refused the roots: Wolfi's index now carries bluez 5.88, glib 2.90.1-r2, gst-plugins-bad 1.28.9, systemd 262.2 and nss-mdns 0.15.1-r1 above our overrides, and check-docs wanted pipewire-doc, which Wolfi now builds. Each recipe moves the way its own reason asks: - bluez 5.88 and gst-plugins-bad 1.28.9, from upstream's tags (Wolfi's index has them before its recipes on GitHub). bluez 5.88 removed attrib/ and gatttool with it; bluetoothctl's gatt menu replaces it. - systemd 262.2, with its manual pages in systemd-doc as Wolfi builds them since 262.2-r1: without ours, apko would take Wolfi's systemd-doc beside our systemd. Installed with the other manuals. - pipewire keeps 1.6.11 and gains pipewire-doc the same way. - glib keeps 2.90.1 at epoch 3. Wolfi's r1 and r2 (LTO, a static build, and its own patch putting GChecksum and GHmac on OpenSSL 4's libcrypto) are not taken: the desktop needs none of them, and glib, under every app, would depend on libcrypto. - nss-mdns goes: Wolfi packages it now, the same release with avahi's socket under /run, so the reason for the recipe is gone. The lock also takes hwdata-pci (pci.ids) as apko now resolves it. Co-Authored-By: Claude Opus 5.5 --- image/apko.lock.yaml | 51 ++++++++++++++++--------------- image/apko.yaml | 2 ++ image/initrd/apko.lock.yaml | 18 +++++------ recipes/bluez.yaml | 12 +++++--- recipes/glib.yaml | 5 ++- recipes/gst-plugins-bad-1.28.yaml | 6 ++-- recipes/nss-mdns.yaml | 41 ------------------------- recipes/pipewire.yaml | 14 +++++++-- recipes/systemd.yaml | 29 ++++++++++++------ 9 files changed, 83 insertions(+), 95 deletions(-) delete mode 100644 recipes/nss-mdns.yaml diff --git a/image/apko.lock.yaml b/image/apko.lock.yaml index a29a714..7d428f2 100644 --- a/image/apko.lock.yaml +++ b/image/apko.lock.yaml @@ -18,8 +18,8 @@ contents: - at-spi2-core-lang=2.62.1-r1 - baobab=50.0-r0 - bibata-cursor-theme=2.0.7-r5 - - bluez=5.87-r5 - - bluez-doc=5.87-r5 + - bluez=5.88-r1 + - bluez-doc=5.88-r1 - bolt=0.9.11-r1 - ccid=1.8.4-r0 - code=1.144.0-r0 @@ -70,10 +70,10 @@ contents: - ghostty=1.3.1-r1 - ghostty-lang=1.3.1-r1 - gjs=1.90.1-r0 - - glib=2.90.1-r1 - - glib-dev=2.90.1-r1 - - glib-doc=2.90.1-r1 - - glib-lang=2.90.1-r1 + - glib=2.90.1-r3 + - glib-dev=2.90.1-r3 + - glib-doc=2.90.1-r3 + - glib-lang=2.90.1-r3 - glib-networking=2.90.1-r0 - glib-networking-lang=2.90.1-r0 - glibmm=2.90.0-r0 @@ -148,7 +148,7 @@ contents: - grilo-plugins-lang=0.3.18-r0 - gsettings-desktop-schemas=51.0-r0 - gsound=1.0.3-r0 - - gst-plugins-bad-1.28=1.28.8-r3 + - gst-plugins-bad-1.28=1.28.9-r1 - gst-plugins-good-1.28=1.28.8-r1 - gst-plugins-rs=0.15.4-r1 - gtk-frdp=0.2.0_git20260724-r0 @@ -206,10 +206,10 @@ contents: - libsoup3-lang=3.8.1-r0 - libspelling=0.4.10-r0 - libspelling-lang=0.4.10-r0 - - libsystemd=262.1-r5 - - libsystemd-compression-libs=262.1-r5 - - libsystemd-shared=262.1-r5 - - libudev=262.1-r5 + - libsystemd=262.2-r2 + - libsystemd-compression-libs=262.2-r2 + - libsystemd-shared=262.2-r2 + - libudev=262.2-r2 - libwacom=2.20.0-r0 - libxmlb=0.3.29-r0 - localsearch=3.12.0-r1 @@ -238,7 +238,6 @@ contents: - networkmanager-openvpn=1.12.5-r0 - networkmanager-openvpn-lang=1.12.5-r0 - networkmanager-wifi=1.58.1-r0 - - nss-mdns=0.15.1-r0 - openssh-client=10.6_p1-r1 - openssh-keygen=10.6_p1-r1 - openssh-server=10.6_p1-r1 @@ -255,8 +254,9 @@ contents: - papers-lang=51.1-r0 - pcsc-lite=2.5.3-r3 - pcsc-lite-doc=2.5.3-r3 - - pipewire=1.6.11-r3 - - pipewire-pulse=1.6.11-r3 + - pipewire=1.6.11-r4 + - pipewire-doc=1.6.11-r4 + - pipewire-pulse=1.6.11-r4 - plymouth=26.134.222_git20260929-r0 - power-profiles-daemon=0.30-r0 - ptyxis=50.1-r1 @@ -283,15 +283,16 @@ contents: - speech-dispatcher-lang=0.12.1-r0 - sudo=1.9.17_p2-r13 - sudo-doc=1.9.17_p2-r13 - - systemd=262.1-r5 - - systemd-boot=262.1-r5 - - systemd-container=262.1-r5 - - systemd-init=262.1-r5 - - systemd-logind-service=262.1-r5 - - systemd-systemctl=262.1-r5 - - systemd-sysupdate=262.1-r5 - - systemd-timesyncd=262.1-r5 - - systemd-userdb=262.1-r5 + - systemd=262.2-r2 + - systemd-boot=262.2-r2 + - systemd-container=262.2-r2 + - systemd-doc=262.2-r2 + - systemd-init=262.2-r2 + - systemd-logind-service=262.2-r2 + - systemd-systemctl=262.2-r2 + - systemd-sysupdate=262.2-r2 + - systemd-timesyncd=262.2-r2 + - systemd-userdb=262.2-r2 - task=3.54.0-r6 - tecla=51.0-r0 - tela-icon-theme=2026.08.10-r3 @@ -299,7 +300,7 @@ contents: - tinysparql-lang=3.12.0-r0 - totem-pl-parser=3.26.7-r0 - totem-pl-parser-lang=3.26.7-r0 - - udev=262.1-r5 + - udev=262.2-r2 - udisks2=2.11.2-r0 - udisks2-lang=2.11.2-r0 - upower=1.91.5-r0 @@ -681,6 +682,7 @@ contents: - harfbuzz=15.0.0-r3 - heimdal-libs=7.8.0-r55 - hicolor-icon-theme=0.18-r8 + - hwdata-pci=0.413-r0 - hwdata-usb=0.412-r0 - i2c-tools-doc=4.4-r14 - icu78-data-full=78.3-r4 @@ -936,6 +938,7 @@ contents: - ngtcp2=1.26.0-r0 - npth-libs=1.8-r16 - nsenter=2.42.4-r2 + - nss-mdns=0.15.1-r0 - oniguruma=6.9.10-r7 - opencore-amr=0.1.6-r6 - openh264=2.7.0-r0 diff --git a/image/apko.yaml b/image/apko.yaml index 0f4a651..ae9e7c5 100644 --- a/image/apko.yaml +++ b/image/apko.yaml @@ -381,6 +381,7 @@ contents: - pciutils-doc - pcsc-lite-doc - perl-doc + - pipewire-doc - pkgconf-doc - polkit-doc - powertop-doc @@ -394,6 +395,7 @@ contents: - sqlite-doc - stress-ng-doc - sudo-doc + - systemd-doc - tiff-doc - vim-doc - wireguard-tools-doc diff --git a/image/initrd/apko.lock.yaml b/image/initrd/apko.lock.yaml index 8f8f13f..1b6b9da 100644 --- a/image/initrd/apko.lock.yaml +++ b/image/initrd/apko.lock.yaml @@ -14,19 +14,19 @@ contents: - device-mapper-event-libs=2.03.44-r1 - device-mapper-libs=2.03.44-r1 - duktape=2.7.0-r3 - - glib=2.90.1-r1 + - glib=2.90.1-r3 - libfido2=1.17.0-r9 - - libsystemd=262.1-r5 - - libsystemd-compression-libs=262.1-r5 - - libsystemd-shared=262.1-r5 - - libudev=262.1-r5 + - libsystemd=262.2-r2 + - libsystemd-compression-libs=262.2-r2 + - libsystemd-shared=262.2-r2 + - libudev=262.2-r2 - lvm2=2.03.44-r1 - pcsc-lite=2.5.3-r3 - plymouth=26.134.222_git20260929-r0 - - systemd=262.1-r5 - - systemd-boot=262.1-r5 - - systemd-systemctl=262.1-r5 - - udev=262.1-r5 + - systemd=262.2-r2 + - systemd-boot=262.2-r2 + - systemd-systemctl=262.2-r2 + - udev=262.2-r2 # Wolfi's: as pinned, or at Wolfi's newest with task lock -- -all. - bash=5.3-r14 - bash-binsh=5.3-r14 diff --git a/recipes/bluez.yaml b/recipes/bluez.yaml index 6f692a5..415978d 100644 --- a/recipes/bluez.yaml +++ b/recipes/bluez.yaml @@ -5,9 +5,10 @@ # Generated from https://git.alpinelinux.org/aports/plain/main/bluez/APKBUILD package: name: bluez - version: "5.87" - # Replaces Wolfi's bluez 5.87 (epoch 4): see the header. - epoch: 5 + version: "5.88" + # Replaces Wolfi's bluez 5.88 (epoch 0), whose recipe Wolfi's index carries before GitHub does: + # see the header. + epoch: 1 description: Tools for the Bluetooth protocol stack copyright: - license: GPL-2.0 AND LGPL-2.1 AND BSD-2-Clause AND MIT @@ -54,7 +55,7 @@ pipeline: with: repository: https://github.com/bluez/bluez tag: ${{package.version}} - expected-commit: 65d11edee469c24dcc8d075b8be9c040cebaaf98 + expected-commit: 34b6f8e0e998728ce9e8e64e280d9d390c511804 - uses: autoconf/configure with: @@ -76,7 +77,8 @@ pipeline: make DESTDIR="${{targets.destdir}}" install install-pluginLTLIBRARIES install -Dm755 test/simple-agent "${{targets.destdir}}"/usr/bin/bluez-simple-agent install -Dm755 tools/btmgmt -t "${{targets.destdir}}"/usr/bin/ - install -Dm755 attrib/gatttool -t "${{targets.destdir}}"/usr/bin/ + # gatttool, deprecated since 5.x, is gone in 5.88 (attrib/ removed): bluetoothctl's gatt + # menu does what it did. install -Dm644 obexd/src/org.bluez.obex.service \ "${{targets.destdir}}"/usr/share/dbus-1/services/org.bluez.obex.service diff --git a/recipes/glib.yaml b/recipes/glib.yaml index 1f35915..c34cfa2 100644 --- a/recipes/glib.yaml +++ b/recipes/glib.yaml @@ -5,10 +5,13 @@ # put Firefox before or after Google Chrome by the session (patch upstream-ready, in glib/). # Its package tests are left out: they use Wolfi's own test pipelines, which melange build does # not run. +# Wolfi's epochs 1 and 2 of the same 2.90.1 (LTO, a static build, and its own patch putting +# GChecksum and GHmac on OpenSSL 4's libcrypto) are not taken: the desktop needs none of them, +# and they would make glib, under every app, depend on libcrypto. The epoch stays above Wolfi's. package: name: glib version: "2.90.1" - epoch: 1 + epoch: 3 description: Common C routines used by Gtk+ and other libs copyright: - license: LGPL-2.1-or-later diff --git a/recipes/gst-plugins-bad-1.28.yaml b/recipes/gst-plugins-bad-1.28.yaml index 7fb4116..51b9b82 100644 --- a/recipes/gst-plugins-bad-1.28.yaml +++ b/recipes/gst-plugins-bad-1.28.yaml @@ -6,8 +6,8 @@ # carried: nothing on the desktop uses WebRTC through GStreamer. package: name: gst-plugins-bad-1.28 - version: "1.28.8" - epoch: 3 + version: "1.28.9" + epoch: 1 description: GStreamer streaming media framework bad plug-ins copyright: - license: LGPL-2.1 @@ -76,7 +76,7 @@ pipeline: with: repository: https://github.com/GStreamer/gstreamer tag: ${{package.version}} - expected-commit: 1b2a95a1b72787cda146b46df9605b168e5b683b + expected-commit: 3ced45da096032bdac8e0922faa492a079c3180e - working-directory: subprojects/gst-plugins-bad pipeline: diff --git a/recipes/nss-mdns.yaml b/recipes/nss-mdns.yaml deleted file mode 100644 index 367e7d3..0000000 --- a/recipes/nss-mdns.yaml +++ /dev/null @@ -1,41 +0,0 @@ -# .local names through avahi-daemon, for glibc's resolver (nsswitch.conf's mdns4_minimal): the -# one mDNS stack on the machine is avahi's, which Files' network browsing and printer discovery -# already use, and systemd-resolved's mDNS is off (resolved.conf.d/10-construct.conf). Wolfi has -# no package of it. -package: - name: nss-mdns - version: 0.15.1 - epoch: 0 - description: glibc NSS module resolving .local names through avahi-daemon - copyright: - - license: LGPL-2.1-or-later - dependencies: - runtime: - - avahi - -environment: - contents: - packages: - - build-base - - busybox - -pipeline: - - uses: fetch - with: - uri: https://github.com/avahi/nss-mdns/releases/download/v${{package.version}}/nss-mdns-${{package.version}}.tar.gz - expected-sha256: ddf71453d7a7cdc5921fe53ef387b24fd0c3c49f4dcf94a2a437498596761a21 - - # The tests need the check library, which the build does not otherwise. - - uses: autoconf/configure - with: - opts: --disable-tests - - - uses: autoconf/make - - - uses: autoconf/make-install - - - runs: | - find "${{targets.destdir}}" -name '*.la' -delete - test -e "${{targets.destdir}}"/usr/lib/libnss_mdns4_minimal.so.2 - - - uses: strip diff --git a/recipes/pipewire.yaml b/recipes/pipewire.yaml index 5450c7e..660a971 100644 --- a/recipes/pipewire.yaml +++ b/recipes/pipewire.yaml @@ -1,8 +1,9 @@ package: name: pipewire version: "1.6.11" - # Replaces Wolfi's pipewire 1.6.11 (epoch 1), which lacks the bluez5 and GStreamer plugins. - epoch: 3 + # Replaces Wolfi's pipewire 1.6.11 (epoch 2), which lacks the bluez5 and GStreamer plugins. Its + # manual pages are built as Wolfi's are, in pipewire-doc: without ours, apko would take Wolfi's. + epoch: 4 description: Server and user space API to deal with multimedia pipelines copyright: - license: MIT @@ -19,6 +20,7 @@ environment: - build-base - busybox - dbus-dev + - doxygen - glib-dev - gst-plugins-base-dev - gstreamer-dev @@ -27,6 +29,7 @@ environment: - meson - ninja - opus-dev + - python3 - readline-dev - sbc-dev - systemd-dev @@ -47,7 +50,7 @@ pipeline: # x11 and libcanberra serve only the X11 bell module, which a Wayland session never loads. - uses: meson/configure with: - opts: -Dsession-managers=[] -Ddocs=disabled -Dman=disabled -Dtests=disabled -Dinstalled_tests=disabled -Dexamples=disabled -Dgstreamer=enabled -Dgstreamer-device-provider=enabled -Dlibsystemd=enabled -Dlogind=enabled -Dlogind-provider=libsystemd -Dsystemd-system-service=disabled -Dsystemd-user-service=enabled -Dsystemd-user-unit-dir=/usr/lib/systemd/user -Dudev=enabled -Dalsa=enabled -Dpipewire-alsa=enabled -Dpipewire-jack=disabled -Djack=disabled -Djack-devel=false -Dpipewire-v4l2=disabled -Dv4l2=enabled -Dlibcamera=enabled -Dbluez5=enabled -Dbluez5-backend-native-mm=disabled -Dbluez5-backend-ofono=disabled -Dbluez5-backend-hsphfpd=disabled -Dbluez5-codec-aptx=disabled -Dbluez5-codec-ldac=disabled -Dbluez5-codec-ldac-dec=disabled -Dbluez5-codec-aac=disabled -Dbluez5-codec-lc3plus=disabled -Dbluez5-codec-lc3=disabled -Dbluez5-codec-opus=enabled -Dbluez5-codec-g722=disabled -Dbluez5-plc-spandsp=disabled -Dopus=enabled -Dlibusb=disabled -Dvulkan=disabled -Dffmpeg=disabled -Dpw-cat-ffmpeg=disabled -Dsdl2=disabled -Dsndfile=enabled -Dlibmysofa=disabled -Dlibpulse=disabled -Droc=disabled -Davahi=disabled -Decho-cancel-webrtc=disabled -Draop=disabled -Dlv2=disabled -Dx11=disabled -Dx11-xfixes=disabled -Dlibcanberra=disabled -Dflatpak=disabled -Dreadline=enabled -Dselinux=disabled -Dlibffado=disabled -Dsnap=disabled -Debur128=disabled -Dfftw=disabled -Donnxruntime=disabled -Dcompress-offload=disabled -Devl=disabled + opts: -Dsession-managers=[] -Ddocs=disabled -Dman=enabled -Dtests=disabled -Dinstalled_tests=disabled -Dexamples=disabled -Dgstreamer=enabled -Dgstreamer-device-provider=enabled -Dlibsystemd=enabled -Dlogind=enabled -Dlogind-provider=libsystemd -Dsystemd-system-service=disabled -Dsystemd-user-service=enabled -Dsystemd-user-unit-dir=/usr/lib/systemd/user -Dudev=enabled -Dalsa=enabled -Dpipewire-alsa=enabled -Dpipewire-jack=disabled -Djack=disabled -Djack-devel=false -Dpipewire-v4l2=disabled -Dv4l2=enabled -Dlibcamera=enabled -Dbluez5=enabled -Dbluez5-backend-native-mm=disabled -Dbluez5-backend-ofono=disabled -Dbluez5-backend-hsphfpd=disabled -Dbluez5-codec-aptx=disabled -Dbluez5-codec-ldac=disabled -Dbluez5-codec-ldac-dec=disabled -Dbluez5-codec-aac=disabled -Dbluez5-codec-lc3plus=disabled -Dbluez5-codec-lc3=disabled -Dbluez5-codec-opus=enabled -Dbluez5-codec-g722=disabled -Dbluez5-plc-spandsp=disabled -Dopus=enabled -Dlibusb=disabled -Dvulkan=disabled -Dffmpeg=disabled -Dpw-cat-ffmpeg=disabled -Dsdl2=disabled -Dsndfile=enabled -Dlibmysofa=disabled -Dlibpulse=disabled -Droc=disabled -Davahi=disabled -Decho-cancel-webrtc=disabled -Draop=disabled -Dlv2=disabled -Dx11=disabled -Dx11-xfixes=disabled -Dlibcanberra=disabled -Dflatpak=disabled -Dreadline=enabled -Dselinux=disabled -Dlibffado=disabled -Dsnap=disabled -Debur128=disabled -Dfftw=disabled -Donnxruntime=disabled -Dcompress-offload=disabled -Devl=disabled - uses: meson/compile @@ -56,6 +59,11 @@ pipeline: - uses: strip subpackages: + - name: pipewire-doc + description: pipewire manual pages + pipeline: + - uses: split/manpages + - name: pipewire-dev pipeline: - uses: split/dev diff --git a/recipes/systemd.yaml b/recipes/systemd.yaml index 7ba9d4d..2cfc744 100644 --- a/recipes/systemd.yaml +++ b/recipes/systemd.yaml @@ -1,19 +1,20 @@ -# Wolfi's systemd (wolfi-dev/os systemd.yaml, 261.3 epoch 5, with its files in systemd/), at -# 262.1, which Wolfi's index carries from a recipe it has not published yet, built with what -# Wolfi turns off and the desktop needs: +# Wolfi's systemd (wolfi-dev/os systemd.yaml, 262.2 epoch 1, with its files in systemd/), built +# with what Wolfi turns off and the desktop needs: # - sysupdate and sysupdated, in their own subpackage: the updates' engine and the D-Bus service # GNOME Software updates the OS through (sysupdated goes in v263, for Varlink: construct-update # and GNOME Software move then). # - FIDO2: Wolfi builds without libfido2, so systemd-cryptenroll cannot enrol a security key and # systemd-cryptsetup has no token to open /var with one (touch and the key's PIN). libfido2 is # opened at run time: the root and the initrd install it themselves. -# TPM2 Wolfi builds itself since its epoch 5. Everything else is Wolfi's, but for the aarch64-only -# patch (we build x86_64), bootctl's random-seed patch (in 262.1) and the package tests, which use -# Wolfi's own test pipelines and which melange build does not run. +# TPM2 Wolfi builds itself since its epoch 5, and the man pages (systemd-doc) since 262.2 epoch 1: +# without ours, apko would take Wolfi's systemd-doc beside this systemd. Everything else is +# Wolfi's, but for the aarch64-only patch (we build x86_64), bootctl's random-seed patch (in +# 262.1) and the package tests, which use Wolfi's own test pipelines and which melange build does +# not run. package: name: systemd - version: "262.1" - epoch: 5 + version: "262.2" + epoch: 2 description: The systemd System and Service Manager copyright: - license: LGPL-2.1-or-later AND GPL-2.0-or-later @@ -78,6 +79,7 @@ environment: - cryptsetup-dev - curl-dev - dbus-dev + - docbook-xml - findutils - glibc-2.44-dev - gnutar @@ -124,7 +126,7 @@ pipeline: with: repository: https://github.com/systemd/systemd tag: v${{package.version}} - expected-commit: 73612ea502d53baf9b0df4336cfc296a7ee0d524 + expected-commit: 63511d7283d7d0e2a2fc28075481afaf1a7be8f5 - uses: patch with: @@ -140,6 +142,8 @@ pipeline: -Dstandalone-binaries=true \ -Dsplit-bin=false \ -Ddefault-dnssec=no \ + -Dman=enabled \ + -Dhtml=disabled \ -Dsysupdate=enabled \ -Dsysupdated=enabled \ -Dtpm2=enabled \ @@ -176,6 +180,13 @@ pipeline: - uses: strip subpackages: + # Keep first: other subpackages glob on names (*machine*, *udev*) and would otherwise take the + # matching man pages. + - name: systemd-doc + description: systemd manpages + pipeline: + - uses: split/manpages + - name: "systemd-test" description: "Installable systemd-tests" dependencies: From 07df5f801e336a7f3deeb17f54640f32e66cc1dd Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Fri, 6 Nov 2026 22:12:33 -0300 Subject: [PATCH 2/6] image: Trayscale, Tailscale in the tray from login Tailscale had a command line and the Construct app's page to join a tailnet; nothing showed its state or switched an exit node at a glance. Trayscale (Construct-Linux/trayscale, gnome-51) is a GTK 4 and libadwaita client with a StatusNotifierItem icon, which the AppIndicator extension shows. It starts at login with --hide-window, in the tray only. The recipe builds what dist.sh would, which needs bash. puregotk dlopens GTK and libadwaita, so the runtime dependencies are declared; the translations are embedded, so there is no -lang. Co-Authored-By: Claude Opus 5.5 --- image/apko.lock.yaml | 1 + image/apko.yaml | 4 +- .../autostart/dev.deedles.Trayscale.desktop | 11 +++++ recipes/trayscale.yaml | 43 +++++++++++++++++++ 4 files changed, 58 insertions(+), 1 deletion(-) create mode 100644 image/rootfs/etc/xdg/autostart/dev.deedles.Trayscale.desktop create mode 100644 recipes/trayscale.yaml diff --git a/image/apko.lock.yaml b/image/apko.lock.yaml index 7d428f2..92c5706 100644 --- a/image/apko.lock.yaml +++ b/image/apko.lock.yaml @@ -300,6 +300,7 @@ contents: - tinysparql-lang=3.12.0-r0 - totem-pl-parser=3.26.7-r0 - totem-pl-parser-lang=3.26.7-r0 + - trayscale=0.21.0-r0 - udev=262.2-r2 - udisks2=2.11.2-r0 - udisks2-lang=2.11.2-r0 diff --git a/image/apko.yaml b/image/apko.yaml index ae9e7c5..25f61f7 100644 --- a/image/apko.yaml +++ b/image/apko.yaml @@ -304,8 +304,10 @@ contents: - iptables-nft # nft, which loads the firewall (usr/lib/construct/firewall.nft). - nftables - # Tailscale (usr/lib/systemd/system/tailscaled.service). + # Tailscale (usr/lib/systemd/system/tailscaled.service), and Trayscale for it from the tray + # (the AppIndicator extension shows the icon). - tailscale + - trayscale # Manuals: man (man-db, its index baked at build: etc/man_db.conf) and the pages of every # command the root has, which Wolfi puts in -doc and nothing installs unless it is named # here. go run ./cmd/image check-docs (in task rootfs) fails the build when one is missing, and diff --git a/image/rootfs/etc/xdg/autostart/dev.deedles.Trayscale.desktop b/image/rootfs/etc/xdg/autostart/dev.deedles.Trayscale.desktop new file mode 100644 index 0000000..797f9ac --- /dev/null +++ b/image/rootfs/etc/xdg/autostart/dev.deedles.Trayscale.desktop @@ -0,0 +1,11 @@ +# Trayscale at login, in the tray only (the AppIndicator extension shows it): Tailscale's state and +# its exit node a click away, without a window. GDM's greeter starts from its own autostart +# directory, not this one. +[Desktop Entry] +Type=Application +Name=Trayscale +Icon=dev.deedles.Trayscale +Exec=trayscale --hide-window +NoDisplay=true +OnlyShowIn=GNOME; +X-GNOME-Autostart-enabled=true diff --git a/recipes/trayscale.yaml b/recipes/trayscale.yaml new file mode 100644 index 0000000..228073d --- /dev/null +++ b/recipes/trayscale.yaml @@ -0,0 +1,43 @@ +package: + name: trayscale + version: "0.21.0" + epoch: 0 + description: GTK 4 and libadwaita client for the Tailscale daemon, with a tray icon + copyright: + - license: MIT + dependencies: + # puregotk loads GTK and libadwaita with dlopen at run time, so melange sees no soname to + # derive them from. + runtime: + - gtk-4 + - libadwaita + +environment: + contents: + packages: + # cgo: the GtkBuilder labels are translated through libintl (internal/locale). + - build-base + - busybox + - go + +pipeline: + # v0.21.0 and upstream master to 67266aa (meta: update dependencies) plus, on the fork's + # gnome-51 branch: macOS install paths dropped and the README's note that the tray icon needs + # the AppIndicator extension. + - uses: git-checkout + with: + repository: https://github.com/Construct-Linux/trayscale + branch: gnome-51 + expected-commit: 5c4c505c59f2e1d6e8d3bab300229df62644eb7e + + # What dist.sh build and install do, which needs bash. The fork carries no tags, so the version + # is given; -buildvcs=false keeps the checkout's state out of the binary. The translations are + # embedded (assets.go), so there is no -lang to split; the schema is compiled with all the + # others when the image is baked. + - runs: | + go build -trimpath -buildvcs=false -ldflags "-s -w -X 'deedles.dev/trayscale/internal/metadata.version=v${{package.version}}'" -o trayscale ./cmd/trayscale + install -Dm755 trayscale ${{targets.destdir}}/usr/bin/trayscale + install -Dm644 dev.deedles.Trayscale.png ${{targets.destdir}}/usr/share/icons/hicolor/256x256/apps/dev.deedles.Trayscale.png + install -Dm644 dev.deedles.Trayscale.desktop ${{targets.destdir}}/usr/share/applications/dev.deedles.Trayscale.desktop + install -Dm644 dev.deedles.Trayscale.metainfo.xml ${{targets.destdir}}/usr/share/metainfo/dev.deedles.Trayscale.metainfo.xml + install -Dm644 dev.deedles.Trayscale.gschema.xml ${{targets.destdir}}/usr/share/glib-2.0/schemas/dev.deedles.Trayscale.gschema.xml From 7c85709cda2ceff32bbe906b53eda1fd1b232f0f Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Fri, 6 Nov 2026 22:24:08 -0300 Subject: [PATCH 3/6] trayscale: the pages' tailscaled calls off the main thread The fork's gnome-51 moves the self, peer and Mullvad pages' calls to tailscaled into goroutines with a timeout, so a slow or stuck daemon no longer freezes the window (upstream #262, #239). Co-Authored-By: Claude Opus 5.5 --- image/apko.lock.yaml | 2 +- recipes/trayscale.yaml | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/image/apko.lock.yaml b/image/apko.lock.yaml index 92c5706..154fbbe 100644 --- a/image/apko.lock.yaml +++ b/image/apko.lock.yaml @@ -300,7 +300,7 @@ contents: - tinysparql-lang=3.12.0-r0 - totem-pl-parser=3.26.7-r0 - totem-pl-parser-lang=3.26.7-r0 - - trayscale=0.21.0-r0 + - trayscale=0.21.0-r1 - udev=262.2-r2 - udisks2=2.11.2-r0 - udisks2-lang=2.11.2-r0 diff --git a/recipes/trayscale.yaml b/recipes/trayscale.yaml index 228073d..5c8a44e 100644 --- a/recipes/trayscale.yaml +++ b/recipes/trayscale.yaml @@ -1,7 +1,7 @@ package: name: trayscale version: "0.21.0" - epoch: 0 + epoch: 1 description: GTK 4 and libadwaita client for the Tailscale daemon, with a tray icon copyright: - license: MIT @@ -22,13 +22,14 @@ environment: pipeline: # v0.21.0 and upstream master to 67266aa (meta: update dependencies) plus, on the fork's - # gnome-51 branch: macOS install paths dropped and the README's note that the tray icon needs - # the AppIndicator extension. + # gnome-51 branch: macOS install paths dropped, the README's note that the tray icon needs the + # AppIndicator extension, and the pages' calls to tailscaled moved off the main thread with a + # timeout, so a slow or stuck daemon no longer freezes the window (upstream #262, #239). - uses: git-checkout with: repository: https://github.com/Construct-Linux/trayscale branch: gnome-51 - expected-commit: 5c4c505c59f2e1d6e8d3bab300229df62644eb7e + expected-commit: 06e9e4ca7277257265428ca5f45f5edeaa68058c # What dist.sh build and install do, which needs bash. The fork carries no tags, so the version # is given; -buildvcs=false keeps the checkout's state out of the binary. The translations are From b96b013299db1c41e08e06732734abb4c6aaa3da Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Fri, 6 Nov 2026 22:24:25 -0300 Subject: [PATCH 4/6] docs: Trayscale among the desktop's apps and forks Co-Authored-By: Claude Opus 5.5 --- .claude/skills/fork-merge/SKILL.md | 2 +- README.md | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.claude/skills/fork-merge/SKILL.md b/.claude/skills/fork-merge/SKILL.md index 71897aa..17098c2 100644 --- a/.claude/skills/fork-merge/SKILL.md +++ b/.claude/skills/fork-merge/SKILL.md @@ -1,6 +1,6 @@ --- name: fork-merge -description: Bring a Construct-Linux fork (Orchis, Tela, Bibata, Vitals, Dash to Panel, Tiling Shell, AppIndicator, Caffeine, Clipboard Indicator) up to its upstream and move its recipe's pin, resolving what task fork:sync could not. Use when asked to update, sync or rebase a fork, port or review upstream's changes, resolve a fork's merge, or when a watch issue says "update: is N commit(s) behind". +description: Bring a Construct-Linux fork (Orchis, Tela, Bibata, Vitals, Dash to Panel, Tiling Shell, AppIndicator, Caffeine, Clipboard Indicator, Trayscale) up to its upstream and move its recipe's pin, resolving what task fork:sync could not. Use when asked to update, sync or rebase a fork, port or review upstream's changes, resolve a fork's merge, or when a watch issue says "update: is N commit(s) behind". --- # Fork merge diff --git a/README.md b/README.md index cfb6de0..e932a24 100644 --- a/README.md +++ b/README.md @@ -14,16 +14,16 @@ rough edges, and say where they are. - **GNOME 51** on Wayland, with GNOME's core apps (Files, Text Editor, Calendar, Maps, Software, Papers, ...), Firefox, Ptyxis and Ghostty, and Flatpak with Flathub, where Chrome comes from. For work: Docker and containerd, VS Code (Microsoft's build, under its license), gcc, make and - git, Tailscale, CUPS, OpenSSH. + git, Tailscale (with Trayscale in the tray), CUPS, OpenSSH. - **Its own look**: Orchis in Construct's colours for the shell, GTK 3 and libadwaita apps alike, following the light/dark switch; Tela icons; Bibata's cursor. A top bar with the clock and indicators on the right, and a small centred dock. Extensions: AppIndicator, Caffeine, Clipboard Indicator, Dash to Panel, Desktop Icons, Drive Menu, Just Perfection, Night Theme Switcher, Tiling Shell, User Theme, Vitals, Workspace Indicator. -- **Built for GNOME 51, fixed where it is not**: the theme, the icons, the cursor and six of the - extensions come from [forks](https://github.com/Construct-Linux) with a `gnome-51` branch - - upstream's issues triaged against this stack, one commit per fix - and each recipe pins its - commit and names the fixes it takes. +- **Built for GNOME 51, fixed where it is not**: the theme, the icons, the cursor, six of the + extensions and Trayscale come from [forks](https://github.com/Construct-Linux) with a + `gnome-51` branch - upstream's issues triaged against this stack, one commit per fix - and each + recipe pins its commit and names the fixes it takes. - **What Wolfi lacks is built here**: 208 melange recipes in `recipes/` - the GNOME stack, and Wolfi packages rebuilt where Wolfi's fall short (mesa with Intel's drivers and Vulkan, PipeWire with Bluetooth audio, systemd with TPM2 and sysupdate, ...). From 65ddb64b89afb81c20a837c28fa5264fa4e07af2 Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Fri, 6 Nov 2026 23:37:19 -0300 Subject: [PATCH 5/6] image: tray icons in the top bar's padding, Trayscale's icon from Tela Trayscale's icon is the first tray icon the session shows, and task test caught two things about it. AppIndicator's compact mode, on by default, sets -natural-hpadding: 10px on each tray icon by hand; off, they take Orchis's panel-button padding like every other button in the bar. And the app showed its own PNG among Tela's icons: the Tela fork now links dev.deedles.Trayscale to preferences-system-network-vpn, as yast-vpn does. Co-Authored-By: Claude Opus 5.5 --- image/apko.lock.yaml | 2 +- image/rootfs/etc/dconf/db/local.d/00-construct | 5 +++++ recipes/tela-icon-theme.yaml | 10 +++++----- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/image/apko.lock.yaml b/image/apko.lock.yaml index 154fbbe..cd98f4a 100644 --- a/image/apko.lock.yaml +++ b/image/apko.lock.yaml @@ -295,7 +295,7 @@ contents: - systemd-userdb=262.2-r2 - task=3.54.0-r6 - tecla=51.0-r0 - - tela-icon-theme=2026.08.10-r3 + - tela-icon-theme=2026.08.10-r4 - tinysparql=3.12.0-r0 - tinysparql-lang=3.12.0-r0 - totem-pl-parser=3.26.7-r0 diff --git a/image/rootfs/etc/dconf/db/local.d/00-construct b/image/rootfs/etc/dconf/db/local.d/00-construct index ebf7b0d..5745470 100644 --- a/image/rootfs/etc/dconf/db/local.d/00-construct +++ b/image/rootfs/etc/dconf/db/local.d/00-construct @@ -66,6 +66,11 @@ custom-command='distrobox enter wolfi' [org/gnome/desktop/wm/preferences] button-layout='appmenu:minimize,maximize,close' +# Tray icons with the top bar's own padding (Orchis's $panel_button_hpadding), like the other +# buttons: compact mode, on by default, sets 10 px on each of them by hand. +[org/gnome/shell/extensions/appindicator] +compact-mode-enabled=false + # The layout: GNOME's top bar stays, with the clock and every indicator on the right, and Dash to # Panel becomes a small dock, centred at the bottom and sized to its icons. Its per-monitor keys # are JSON by monitor id, falling back to the index: "0" to "2" cover three monitors whatever diff --git a/recipes/tela-icon-theme.yaml b/recipes/tela-icon-theme.yaml index 17f5acd..44d7645 100644 --- a/recipes/tela-icon-theme.yaml +++ b/recipes/tela-icon-theme.yaml @@ -1,7 +1,7 @@ package: name: tela-icon-theme version: 2026.08.10 - epoch: 3 + epoch: 4 description: Tela flat icon theme (Tela, Tela-dark) copyright: - license: GPL-3.0-or-later @@ -18,14 +18,14 @@ environment: - busybox pipeline: - # The fork's gnome-51 branch: upstream master (2026-08-10) plus an icon for Decibels, the - # one visible app of the image Tela had none for, and upstream's blues recolored to the - # palette's folder teal. + # The fork's gnome-51 branch: upstream master (2026-08-10) plus icons for Decibels and + # Trayscale, the visible apps of the image Tela had none for, and upstream's blues recolored + # to the palette's folder teal. - uses: git-checkout with: repository: https://github.com/Construct-Linux/Tela-icon-theme branch: gnome-51 - expected-commit: c04ab2651851c529d516153338fadecfbed837aa + expected-commit: c9baa9e8470b3e647703fb1274f41abf983a73aa # Only the standard folder colour: each further colour is another full copy of the theme. - runs: | From 47f00216173b69ac28055f5f62d5758f89354a7a Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Fri, 6 Nov 2026 23:37:19 -0300 Subject: [PATCH 6/6] trayscale: tailscale.com 1.104.5, tray 0.2.0, x/net 0.62.0 The fork's gnome-51 takes the daemon's patch releases (Construct ships 1.104.4), deedles.dev/tray 0.2.0, which writes menu replies under the menu lock (a race behind tray menus that stop answering, upstream #239), and x/net 0.62.0. Co-Authored-By: Claude Opus 5.5 --- image/apko.lock.yaml | 2 +- recipes/trayscale.yaml | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/image/apko.lock.yaml b/image/apko.lock.yaml index cd98f4a..6ee7a74 100644 --- a/image/apko.lock.yaml +++ b/image/apko.lock.yaml @@ -300,7 +300,7 @@ contents: - tinysparql-lang=3.12.0-r0 - totem-pl-parser=3.26.7-r0 - totem-pl-parser-lang=3.26.7-r0 - - trayscale=0.21.0-r1 + - trayscale=0.21.0-r2 - udev=262.2-r2 - udisks2=2.11.2-r0 - udisks2-lang=2.11.2-r0 diff --git a/recipes/trayscale.yaml b/recipes/trayscale.yaml index 5c8a44e..4c756b8 100644 --- a/recipes/trayscale.yaml +++ b/recipes/trayscale.yaml @@ -1,7 +1,7 @@ package: name: trayscale version: "0.21.0" - epoch: 1 + epoch: 2 description: GTK 4 and libadwaita client for the Tailscale daemon, with a tray icon copyright: - license: MIT @@ -24,12 +24,13 @@ pipeline: # v0.21.0 and upstream master to 67266aa (meta: update dependencies) plus, on the fork's # gnome-51 branch: macOS install paths dropped, the README's note that the tray icon needs the # AppIndicator extension, and the pages' calls to tailscaled moved off the main thread with a - # timeout, so a slow or stuck daemon no longer freezes the window (upstream #262, #239). + # timeout, so a slow or stuck daemon no longer freezes the window (upstream #262, #239), and + # tailscale.com 1.104.5, tray 0.2.0 (a menu race behind #239) and x/net 0.62.0. - uses: git-checkout with: repository: https://github.com/Construct-Linux/trayscale branch: gnome-51 - expected-commit: 06e9e4ca7277257265428ca5f45f5edeaa68058c + expected-commit: 21624a491bad3e43441561f276f2a0c6b16b05f0 # What dist.sh build and install do, which needs bash. The fork carries no tags, so the version # is given; -buildvcs=false keeps the checkout's state out of the binary. The translations are