[shovon]

Closes #357. A pushed tag now also puts an AppImage for x64 and arm64 on the draft Release. A user on any distribution downloads it, makes it executable and runs it, with nothing installed. On the way, Linux docks now show Pb Notes' icon for its window, which they didn't for any Linux package.

The AppImage

• Made by @reforged/maker-appimage, the community Forge maker the issue suggested; electron-builder wasn't needed. It's named as the Windows installers are: Pb Notes-<version>-x64.AppImage and …-arm64.AppImage.
• AppImage's fixed 20251108 runtime, not the maker's default, the moving continuous build. It's the static type2 runtime, so it needs FUSE 3, which Ubuntu Desktop ships, and no libfuse2. It's picked for the CPU of the machine building, which on Linux is always the target (Linux release job, with Deb and RPM packages for x64 and arm64 #356).
• Its desktop entry is pbnotes.desktop, as in the other packages, rather than the maker's "Pb Notes.desktop".

Ubuntu's sandbox block

On Ubuntu 23.10 and later, AppArmor blocks unprivileged user namespaces for apps without a profile of their own. An AppImage runs from a mount that ignores setuid, so it can't fall back to a setuid chrome-sandbox as the .deb does, and Electron crashed before the app's code ran.

• AppRun is a launch script, app/appimage/pbnotes-appimage, which adds --no-sandbox only where the system blocks the sandbox: Ubuntu's AppArmor setting, older Debian's unprivileged_userns_clone, or a limit of no user namespaces at all. Everywhere else (Arch, Omarchy, Fedora…) the app keeps the full sandbox.
• The script is copied into the packaged app after packaging, since the maker images the packaged app as it is. The .deb, .rpm and Arch package carry it too, unused: they start the app directly, with their setuid chrome-sandbox.
• The README says so, and points Ubuntu users to the .deb for the sandbox.

The dock icon (every Linux package)

GNOME's dock matches a window to its .desktop file by the ID the window reports. Pb Notes' window reported pb-notes, which Electron makes from "Pb Notes", and that matched neither pbnotes.desktop nor its StartupWMClass=Pb Notes. Search found the app, but the running window showed a generic icon, with the .deb as with the AppImage.

• desktopName in app/package.json makes the window's ID pbnotes, on Wayland and X11 alike.
• One desktop template for the .deb and .rpm, app/linux/desktop.ejs, sets StartupWMClass=pbnotes; the makers' own set it to the display name. The Arch package gets it from the .deb.
• app/CLAUDE.md lists the desktop entry and the window class among the places the pbnotes identifier is used.

The release workflow

• The Linux job installs squashfs-tools for the maker, and collects the AppImage with the .deb and .rpm.
• The AppImage is smoke-tested twice on each runner: with Ubuntu's block on, where it can only start if the launch script drops the sandbox, and with it off, where it keeps the sandbox.
• The smoke test now checks the window's class is pbnotes, for every package, and the .deb step checks the installed desktop entry's StartupWMClass.

README

A new "AppImage, for any distribution" section: which file suits which processor, how to run it from a terminal or a file manager, that it isn't added to the launcher (so the dock may show a generic icon, which Gear Lever can fix) and doesn't update itself, what to do if FUSE is missing, and that on Ubuntu it runs without the sandbox, so the .deb is better there.

Testing

• CI, started by hand on this branch (run): both AppImages built and showed their window with Ubuntu's block on and off, and every Linux package showed a window of class pbnotes. Every other job passed as before, and release was skipped, as it is for a run started by hand.
• On Ubuntu, with the AppImage from an earlier run on this branch: it opens and works, with no flags.
• On Omarchy (Arch Linux ARM), unpackaged: the launch script finds no block and starts the app with the sandbox. The window's ID was pb-notes before desktopName and pbnotes after, on Wayland and on X11 (XWayland).
• Not yet tried by hand: the dock icon on GNOME with the .deb from the last run.

🤖 Generated with Claude Code