[US-2010] Upgrade to Wails v3.0.0 stable with GTK4 on Linux

.github/workflows/ci.yml

@@ -20,7 +20,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        # Linux tests on the oldest supported Ubuntu, the one releases build on.
+        os: [ubuntu-24.04, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v5
@@ -47,28 +48,17 @@ jobs:
         shell: bash
         run: |
           sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev build-essential xvfb
-
-      - name: Configure Linux GTK3 build tag
-        # Wails alpha.93 promoted GTK4 + WebKitGTK 6.0 to the Linux default;
-        # the only GTK headers installed on the runner are GTK3 + WebKit2GTK 4.1
-        # (the "Install Linux native deps" step above). Without the `gtk3` build
-        # tag, `go vet`, `go test`, `golangci-lint`, and `wails3 generate bindings`
-        # all type-check `pkg/application/application_linux.go` which `#cgo`s
-        # `pkg-config gtk4 webkitgtk-6.0` and fails. GOFLAGS propagates the tag
-        # to every subsequent `go`/`go list`/go-packages-based invocation in
-        # this job. The Wails build step below still needs `EXTRA_TAGS=gtk3`
-        # explicitly because the Taskfile combines it with `-tags production`
-        # to form BUILD_FLAGS (`build/linux/Taskfile.yml:57`); a CLI
-        # `-tags gtk3` arg on `wails3 build` does NOT reach the Taskfile's
-        # BUILD_FLAGS construction.
-        if: runner.os == 'Linux'
-        shell: bash
-        run: echo "GOFLAGS=-tags=gtk3" >> "$GITHUB_ENV"
+          sudo apt-get install -y libgtk-4-dev libwebkitgtk-6.0-dev build-essential xvfb
 
       - name: Install Wails v3 CLI
         shell: bash
-        run: go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.18
+        run: go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0
+
+      - name: Wails doctor (Linux GTK4 stack)
+        # Lists the GTK4 / WebKitGTK 6.0 packages the runner builds against.
+        if: runner.os == 'Linux'
+        shell: bash
+        run: wails3 doctor
 
       - name: Install golangci-lint v2
         shell: bash
@@ -190,29 +180,58 @@ jobs:
 
       - name: Wails build (GUI)
         shell: bash
-        # Wails alpha.93 promoted GTK4 + WebKitGTK 6.0 to the Linux default.
-        # CI installs the libgtk-3-dev + libwebkit2gtk-4.1-dev stack, so on
-        # Linux we drive the linux:build task with `EXTRA_TAGS=gtk3` (the
-        # Taskfile combines it into `-tags production,gtk3`, which propagates
-        # to `wails3 generate bindings -f` -- matches release.yml). macOS and
-        # Windows use the default `wails3 build` path.
+        # Linux drives the linux:build task directly (matches release.yml);
+        # macOS and Windows use the default `wails3 build` path.
         run: |
           if [ "$RUNNER_OS" = "Linux" ]; then
-            wails3 task linux:build EXTRA_TAGS=gtk3
+            wails3 task linux:build
           else
             wails3 build
           fi
 
+      - name: CLI build sanity check
+        shell: bash
+        run: go build -o bin/pdfdebug ./cmd/cli/
+
+      - name: Linux packages
+        # Builds the .deb and .rpm from the GUI binary above, checks the .deb
+        # carries the binaries and the AppArmor profile, and installs it so the
+        # boot smoke runs the packaged binary.
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          export VERSION=0.0.0-ci GOARCH=amd64
+          wails3 task linux:generate:deb
+          wails3 task linux:generate:rpm
+          contents=$(dpkg-deb -c bin/unidoc-pdf-debugger.deb)
+          echo "$contents"
+          for f in ./usr/bin/unidoc-pdf-debugger ./usr/bin/pdfdebug ./etc/apparmor.d/unidoc-pdf-debugger ./usr/share/applications/unidoc-pdf-debugger.desktop; do
+            grep -q " $f\$" <<<"$contents" || { echo "missing from .deb: $f"; exit 1; }
+          done
+          # Recommends would add the portal backend, which the boot smoke's
+          # private D-Bus session is not set up for.
+          sudo apt-get install -y --no-install-recommends ./bin/unidoc-pdf-debugger.deb
+          profiles=$(sudo aa-status)
+          grep -q unidoc-pdf-debugger <<<"$profiles" || { echo "AppArmor profile not loaded"; exit 1; }
+
       - name: Boot-smoke
         shell: bash
         timeout-minutes: 5
         run: |
           if [[ "$RUNNER_OS" == "Linux" ]]; then
-            cd tests/boot-smoke && xvfb-run -a go test -count=1 -timeout 3m ./...
+            # gdb lets the boot-smoke hang report print native thread stacks.
+            sudo apt-get install -y gdb
+            # The runner, like Ubuntu 24.04, blocks unprivileged user
+            # namespaces; the installed binary starts only because the
+            # package's AppArmor profile allows them for WebKit's sandbox.
+            [ "$(sysctl -n kernel.apparmor_restrict_unprivileged_userns)" = 1 ] \
+              || { echo "user namespace restriction is off; the boot smoke would not test the profile"; exit 1; }
+            # A private session bus: on the runner's systemd user bus the
+            # desktop portal does not answer, and GTK4's startup D-Bus proxies
+            # wait the full 25s timeout before the app activates.
+            cd tests/boot-smoke && BOOT_SMOKE_BINARY=/usr/bin/unidoc-pdf-debugger \
+              xvfb-run -a dbus-run-session -- go test -count=1 -timeout 3m ./...
           else
             cd tests/boot-smoke && go test -count=1 -timeout 3m ./...
           fi
-
-      - name: CLI build sanity check
-        shell: bash
-        run: go build -o bin/pdfdebug ./cmd/cli/

.github/workflows/release.yml

@@ -30,7 +30,8 @@ jobs:
           # found macos-13 runner queue times unreliable. Re-add if user demand surfaces.
           - { os: macos-latest,   arch: arm64, goos: darwin,  platform: darwin-arm64 }
           - { os: windows-latest, arch: amd64, goos: windows, platform: windows-amd64 }
-          - { os: ubuntu-latest,  arch: amd64, goos: linux,   platform: linux-amd64 }
+          # Oldest supported Ubuntu: the binary needs this glibc or newer.
+          - { os: ubuntu-24.04,   arch: amd64, goos: linux,   platform: linux-amd64 }
     runs-on: ${{ matrix.os }}
     timeout-minutes: 25
     steps:
@@ -61,23 +62,11 @@ jobs:
         shell: bash
         run: |
           sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev build-essential
-
-      - name: Configure Linux GTK3 build tag
-        # Wails alpha.93 promoted GTK4 + WebKitGTK 6.0 to the Linux default.
-        # The runner installs the GTK3 stack only, so propagate `-tags=gtk3`
-        # via GOFLAGS to every Go-tool invocation in this job (most notably
-        # `wails3 generate bindings -clean=true`, which uses go/packages and
-        # would otherwise fail to type-check pkg/application's CGo GTK4 file).
-        # `wails3 task linux:build` below still needs `EXTRA_TAGS=gtk3`
-        # explicitly because the Taskfile combines it with `-tags production`.
-        if: runner.os == 'Linux'
-        shell: bash
-        run: echo "GOFLAGS=-tags=gtk3" >> "$GITHUB_ENV"
+          sudo apt-get install -y libgtk-4-dev libwebkitgtk-6.0-dev build-essential
 
       - name: Install Wails v3 CLI
         shell: bash
-        run: go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.18
+        run: go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0
 
       - name: Install frontend deps
         shell: bash
@@ -183,7 +172,7 @@ jobs:
           INFO_VERSION="${VERSION%%-*}"
           INFO_VERSION="${INFO_VERSION%%+*}"
           jq --arg v "$INFO_VERSION" \
-            '.fixed.file_version = $v | .info["0000"].ProductVersion = $v' \
+            '.fixed.file_version = $v | .info["0409"].ProductVersion = $v' \
             build/windows/info.json > build/windows/info.json.tmp
           mv build/windows/info.json.tmp build/windows/info.json
           cat build/windows/info.json
@@ -269,17 +258,13 @@ jobs:
           test -f "bin/unidoc-pdf-debugger.exe"
 
       - name: Build Linux GUI
-        if: matrix.os == 'ubuntu-latest'
+        if: matrix.os == 'ubuntu-24.04'
         shell: bash
         env:
           ARCH: ${{ matrix.arch }}
-        # Wails alpha.93 promoted GTK4 + WebKitGTK 6.0 to the Linux default.
-        # The runner installs the libgtk-3-dev + libwebkit2gtk-4.1-dev stack;
-        # EXTRA_TAGS=gtk3 opts back into the legacy GTK3 build path so the
-        # CGo link resolves against the installed headers.
         run: |
           set -euo pipefail
-          wails3 task linux:build ARCH="$ARCH" EXTRA_TAGS=gtk3
+          wails3 task linux:build ARCH="$ARCH"
           test -f "bin/unidoc-pdf-debugger"
 
       - name: Install create-dmg
@@ -341,7 +326,7 @@ jobs:
               build_dmg || build_dmg --skip-jenkins
               # A failed first attempt leaves its own rw.<pid>.*.dmg scratch that
               # the retry (a new pid) does not remove; clear any scratch so only
-              # the final .dmg reaches the artifact upload (EXPECTED_FILES=6).
+              # the final .dmg reaches the artifact upload (EXPECTED_FILES=8).
               rm -f dist/rw.*.dmg
               # Confirm the output is a valid disk image before it feeds the
               # SHA256SUMS job.
@@ -392,6 +377,12 @@ jobs:
               cp LICENSE NOTICE "$CLI_STAGE/"
               tar -czf "dist/pdfdebug-cli-${VERSION}-${PLATFORM}.tar.gz" \
                   -C "$CLI_STAGE" .
+              # .deb (installs the AppArmor profile Ubuntu 23.10+ needs for
+              # WebKit's sandbox) and .rpm, both with the GUI and the CLI.
+              GOARCH=amd64 wails3 task linux:generate:deb
+              GOARCH=amd64 wails3 task linux:generate:rpm
+              cp bin/unidoc-pdf-debugger.deb "dist/unidoc-pdf-debugger-${VERSION}-${PLATFORM}.deb"
+              cp bin/unidoc-pdf-debugger.rpm "dist/unidoc-pdf-debugger-${VERSION}-${PLATFORM}.rpm"
               ;;
           esac
           ls -la dist/
@@ -413,7 +404,7 @@ jobs:
 
   release:
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       # Exposed for the downstream `homebrew` job: the homebrew job gates its
       # execution on `needs.release.outputs.prerelease == 'false'` and reuses
@@ -461,19 +452,21 @@ jobs:
           cat SHA256SUMS.txt
           # Manifest integrity guard: refuse to publish if the manifest is empty, the
           # line count drifts from the number of files staged for release, or the file
-          # count drifts from the 6 release artifacts = 3 platforms x 2 archives each
-          # (a GUI archive, which now also embeds the CLI, plus a standalone CLI
-          # archive). The bundled-in CLI is not a separate file and is not counted.
-          # The 6 expected filenames are:
+          # count drifts from the 8 release artifacts: per platform a GUI archive, which
+          # also embeds the CLI, plus a standalone CLI archive, and on Linux a .deb and
+          # an .rpm. The bundled-in CLI is not a separate file and is not counted.
+          # The 8 expected filenames are:
           #   unidoc-pdf-debugger-<ver>-darwin-arm64.dmg
           #   pdfdebug-cli-<ver>-darwin-arm64.tar.gz
           #   unidoc-pdf-debugger-<ver>-windows-amd64.zip
           #   pdfdebug-cli-<ver>-windows-amd64.zip
           #   unidoc-pdf-debugger-<ver>-linux-amd64.tar.gz
           #   pdfdebug-cli-<ver>-linux-amd64.tar.gz
+          #   unidoc-pdf-debugger-<ver>-linux-amd64.deb
+          #   unidoc-pdf-debugger-<ver>-linux-amd64.rpm
           # Catches any future staging regression that drops or duplicates an
           # artifact before it reaches the Release page.
-          EXPECTED_FILES=6
+          EXPECTED_FILES=8
           FILES=$(find . -maxdepth 1 -type f ! -name SHA256SUMS.txt | wc -l | tr -d ' ')
           LINES=$(wc -l < SHA256SUMS.txt | tr -d ' ')
           if [ "$FILES" -eq 0 ]; then
@@ -485,7 +478,7 @@ jobs:
             exit 1
           fi
           if [ "$FILES" != "$EXPECTED_FILES" ]; then
-            echo "Expected $EXPECTED_FILES release artifacts (3 platforms x 2 artifacts), got $FILES." >&2
+            echo "Expected $EXPECTED_FILES release artifacts (a GUI and a CLI archive per platform, plus the Linux .deb and .rpm), got $FILES." >&2
             find . -maxdepth 1 -type f ! -name SHA256SUMS.txt | LC_ALL=C sort >&2
             exit 1
           fi

.gitignore

@@ -44,7 +44,8 @@ dist
 
 # Wails build scaffolding -- ignore everything except config files we customize.
 # Tracked config files: config.yml, Taskfile.yml (common tasks included by per-platform
-# Taskfiles), darwin/Info.plist, linux/*.desktop, windows/info.json, plus the
+# Taskfiles), darwin/Info.plist, linux/*.desktop, the Linux nfpm package config
+# and its scripts, the Linux AppArmor profile, windows/info.json, plus the
 # per-platform Taskfile.yml (customised with the -X main.version ldflag).
 # These are force-added with git add -f.
 build/*
@@ -59,6 +60,14 @@ build/darwin/*
 build/linux/*
 !build/linux/unidoc-pdf-debugger.desktop
 !build/linux/Taskfile.yml
+!build/linux/apparmor
+!build/linux/nfpm
+build/linux/nfpm/*
+!build/linux/nfpm/nfpm.yaml
+!build/linux/nfpm/scripts
+build/linux/nfpm/scripts/*
+!build/linux/nfpm/scripts/postinstall.sh
+!build/linux/nfpm/scripts/postremove.sh
 !build/windows
 build/windows/*
 !build/windows/info.json