3.6 KiB
Portable Linux release
VernierCAD's portable Linux artifact is a type-2 AppImage built from one exact, clean Git revision. It contains the statically linked OCCT app and sibling worker, the OCCT runtime resources needed by STEP/IGES, the application fonts and license texts, and only the non-base shared libraries reached from the two shipped ELF binaries.
Immutable inputs
The source revision, version, SOURCE_DATE_EPOCH, OCCT source revision, packaging
tool hashes, and every regular AppDir file hash are recorded in the sorted
usr/share/vernier/release-manifest.tsv. The finished AppImage has a sibling
.sha256 file. The two packaging inputs are pinned by content in
packaging/appimage/tools.sha256:
- appimagetool 1.9.1:
ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0 - type2 runtime built from commit
75849dce7cc37e4319b633df1f116ca895c71a12:1cc49bcf1e2ccd593c379adb17c9f85a36d619088296504de95b1d06215aebbf
The continuous-release URL is not trusted as an identity. A cached file with the wrong hash is refused and left untouched.
Prepare tools without hiding network access
Populate or validate the cache once:
scripts/fetch-appimage-tools.sh target/appimage-tools
For an offline build, pre-populate both exact files and require cache-only validation:
scripts/fetch-appimage-tools.sh --offline target/appimage-tools
The builder always uses the offline form. It never downloads as a side effect.
Build from an exact source commit
Use a clean detached worktree whose HEAD is the revision being packaged. Prepare
the pinned static OCCT tree as described in docs/VENDORED_OCCT_RELEASE.md; a
previously verified tree is reusable and should not be rebuilt. Then run:
release_sha=$(git rev-parse HEAD)
scripts/build-appimage.sh --version 0.0.4-alpha --revision "$release_sha"
scripts/smoke-appimage.sh --version 0.0.4-alpha --revision "$release_sha" \
target/appimage/VernierCAD-0.0.4-alpha-x86_64.AppImage
The build is locked, refuses a dirty checkout or a revision other than exact
HEAD, links against VERNIER_OCCT_STATIC_ROOT, verifies that neither executable
has an OCCT dynamic dependency, stages an AppDir, normalizes all mtimes, and invokes
only the hash-verified builder and runtime. The base-runtime allowlist is limited to
the ELF loader and glibc family (libc, libdl, libm, libpthread, libresolv,
librt, libutil, libanl, and libnss_*). Every other dependency found
recursively by ldd is copied and receives an $ORIGIN-relative RPATH.
Run and certify without FUSE
No FUSE mount is required. Extraction and execution use the AppImage runtime's portable mode:
APPIMAGE_EXTRACT_AND_RUN=1 \
target/appimage/VernierCAD-0.0.4-alpha-x86_64.AppImage
scripts/smoke-appimage.sh requires the expected version and exact detached
40-hex source revision. It extracts without FUSE and verifies those identities,
the AppDir, desktop id, product name, sibling worker, manifest inventory and file
hashes, exact artifact-checksum row, and dependency audit. Certification must additionally launch
with an empty XDG home, a PATH containing no project build tree, and native
VERNIER_READBACK evidence. Keep the managed local installation unchanged.
Task 15 performs one structural/native certification build at the immutable packaging-source revision. It deliberately does not repeat driven modelling. Task 16 rebuilds from the final SHA and owns the representative installed workflow, the L3 positive and exact negative controls, independent STEP/STL checks, the one final full gate, and the managed-launcher switch.