distribution/: all channels in one place + add Snap, Flatpak, AppImage, FreeBSD

Every channel now lives under distribution/ (moved snap + nfpm/deb-rpm from
packaging/). Added: snap (snapcraft.yaml, classic), flatpak (manifest +
flatpak-spawn wrapper), appimage (AppRun + .desktop + build.sh, built in CI),
freebsd (port Makefile + pkg-descr). release.yml linux job now also builds the
AppImage; submit-packages.mjs + workflow know the new channels. README has the
full OS matrix (mac, windows, debian/ubuntu, fedora/redhat/suse, arch, gentoo,
nixos, snap, flatpak, appimage, freebsd, arm64 mobile linux, ios/android).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ralyodio

.github/workflows/release.yml

@@ -61,12 +61,14 @@ jobs:
         if: matrix.platform != 'windows'
         run: bash apps/desktop/scripts/build-release.sh "v${{ needs.create-release.outputs.version }}" ${{ matrix.platform }}
 
-      - name: Package (linux deb + rpm)
+      - name: Package (linux deb + rpm + AppImage)
         if: matrix.platform == 'linux'
         run: |
           curl -sSfL "https://github.com/goreleaser/nfpm/releases/download/v2.41.0/nfpm_2.41.0_amd64.deb" -o /tmp/nfpm.deb
           sudo dpkg -i /tmp/nfpm.deb
-          bash packaging/build-deb-rpm.sh "v${{ needs.create-release.outputs.version }}"
+          sudo apt-get update -qq && sudo apt-get install -y -qq librsvg2-bin
+          bash distribution/deb-rpm/build.sh "v${{ needs.create-release.outputs.version }}"
+          bash distribution/appimage/build.sh "v${{ needs.create-release.outputs.version }}"
 
       - name: Package (windows)
         if: matrix.platform == 'windows'
@@ -88,7 +90,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           shopt -s nullglob
-          assets=(dist/tronbrowser-*.tar.gz dist/tronbrowser-*.zip dist/*.deb dist/*.rpm)
+          assets=(dist/tronbrowser-*.tar.gz dist/tronbrowser-*.zip dist/*.deb dist/*.rpm dist/*.AppImage)
           gh release upload "${{ needs.create-release.outputs.tag }}" "${assets[@]}" --clobber
 
   # 3) Publish (un-draft) once every platform has uploaded.

.github/workflows/submit-packages.yml

@@ -40,7 +40,7 @@ jobs:
         run: |
           PMS="${{ github.event.inputs.package_managers }}"
           [ -z "$PMS" ] && PMS="all"
-          if [ "$PMS" = "all" ]; then PMS="homebrew,scoop,winget,aur,apt,rpm,gentoo,nix"; fi
+          if [ "$PMS" = "all" ]; then PMS="homebrew,scoop,winget,aur,apt,rpm,gentoo,nix,snap,flatpak,appimage,freebsd"; fi
           echo "list=$(echo "$PMS" | sed 's/chocolatey,*//g')" >> "$GITHUB_OUTPUT"
 
       - name: Refresh + submit manifests

distribution/README.md

@@ -1,50 +1,56 @@
 # Distribution channels
 
-How TronBrowser reaches users — the same channel set as pairux.com, kept in this
-**single monorepo** (no per-package repos). GitHub Releases is the source of
-truth; package managers consume the release assets.
+Every channel lives **here** in the one monorepo (no per-package repos), modeled
+on pairux.com. GitHub Releases is the source of truth; each channel consumes the
+release assets. Goal: every major OS + open-source platform.
 
-## Channels
+## Platform matrix
 
-| Channel | Manifest | Artifact | Status |
+| OS / family | Channel | Manifest | Status |
 | --- | --- | --- | --- |
-| `curl \| sh` | [`apps/web/public/install.sh`](../apps/web/public/install.sh) | linux tar.gz / macos zip | ✅ live |
-| GitHub Releases | [`release.yml`](../.github/workflows/release.yml) | all | ✅ live |
-| Homebrew | [`homebrew/tronbrowser.rb`](homebrew/tronbrowser.rb) | linux tar.gz / macos zip | 🟡 formula ready (needs `profullstack/homebrew-tap`) |
-| AUR | [`aur/PKGBUILD`](aur/PKGBUILD) | linux tar.gz | 🟡 ready (needs `AUR_SSH_KEY`) |
-| Nix | [`nix/tronbrowser.nix`](nix/tronbrowser.nix) | linux tar.gz | 🟡 ready |
-| Gentoo | [`gentoo/`](gentoo/) | linux tar.gz | 🟡 ebuild ready |
-| apt (.deb) | [`packaging/nfpm.yaml`](../packaging/nfpm.yaml) | built by nfpm in CI | 🟡 built, needs an apt repo |
-| rpm (.rpm) | [`packaging/nfpm.yaml`](../packaging/nfpm.yaml) | built by nfpm in CI | 🟡 built, needs a yum repo |
-| Scoop | [`scoop/tronbrowser.json`](scoop/tronbrowser.json) | win zip | ⬜ needs Windows artifact hash |
-| winget | [`winget/`](winget/) | win zip | ⬜ needs Windows artifact + winget-pkgs PR |
-| Chocolatey | [`chocolatey/`](chocolatey/) | win zip | ⬜ needs Windows artifact + `CHOCOLATEY_API_KEY` |
+| **All** | `curl \| sh` | [`apps/web/public/install.sh`](../apps/web/public/install.sh) | ✅ live |
+| **All** | GitHub Releases | [`release.yml`](../.github/workflows/release.yml) | ✅ live |
+| macOS / Linux | Homebrew | [`homebrew/`](homebrew/) | 🟡 formula ready (needs tap repo) |
+| Windows | Scoop | [`scoop/`](scoop/) | ⬜ needs win zip hash |
+| Windows | winget | [`winget/`](winget/) | ⬜ needs winget-pkgs PR |
+| Windows | Chocolatey | [`chocolatey/`](chocolatey/) | ⬜ needs `CHOCOLATEY_API_KEY` |
+| Debian / Ubuntu | apt (.deb) | [`deb-rpm/`](deb-rpm/) (nfpm) | ✅ built in CI |
+| RedHat / Fedora / SUSE | rpm (.rpm) | [`deb-rpm/`](deb-rpm/) (nfpm) | ✅ built in CI |
+| Arch | AUR | [`aur/PKGBUILD`](aur/PKGBUILD) | 🟡 needs `AUR_SSH_KEY` |
+| Gentoo | ebuild | [`gentoo/`](gentoo/) | 🟡 overlay ready |
+| NixOS | Nix | [`nix/tronbrowser.nix`](nix/tronbrowser.nix) | 🟡 ready |
+| Ubuntu / universal | Snap | [`snap/snapcraft.yaml`](snap/snapcraft.yaml) | 🟡 classic snap (Snap Store login) |
+| Universal Linux | Flatpak | [`flatpak/`](flatpak/) | 🟡 manifest ready (Flathub PR) |
+| Universal Linux | AppImage | [`appimage/`](appimage/) | ✅ built in CI |
+| FreeBSD | port | [`freebsd/`](freebsd/) | 🟡 port ready |
+| Librem 5 / PinePhone / Ubuntu Touch | `curl \| sh` (arm64) | install.sh | ✅ noarch launcher |
+| iOS / Android | Expo / EAS | [`apps/mobile`](../apps/mobile) | 🚧 Phase 2 |
 
 ## CI/CD (per platform, one repo)
 
-[`release.yml`](../.github/workflows/release.yml) runs on a `v*` tag:
+[`release.yml`](../.github/workflows/release.yml) on a `v*` tag:
 
-1. **create-release** — open a draft GitHub Release.
-2. **build** (matrix: `ubuntu-latest` → linux tar.gz + .deb + .rpm,
-   `macos-latest` → macos zip, `windows-latest` → win zip) — each runner builds
-   its platform's artifacts and `gh release upload`s them to the draft.
-3. **publish** — un-draft once all platforms uploaded.
+1. **create-release** — draft GitHub Release.
+2. **build** matrix — `ubuntu` (linux tar.gz + .deb + .rpm + AppImage),
+   `macos` (zip), `windows` (win zip); each uploads via `gh release upload`.
+3. **publish** — un-draft.
 
-[`submit-packages.yml`](../.github/workflows/submit-packages.yml) runs on release
-publish (or manual dispatch with `version` / `dry_run` / `package_managers`). It
-runs [`scripts/submit-packages.mjs`](../scripts/submit-packages.mjs) to refresh
-each manifest's version + sha256 from the release assets, then submits per
+[`submit-packages.yml`](../.github/workflows/submit-packages.yml) on release publish
+(or dispatch) runs [`scripts/submit-packages.mjs`](../scripts/submit-packages.mjs)
+to refresh each manifest's version + sha256 from the release assets and submit per
 channel — gated on that channel's secret, dry-run by default.
 
-## Secrets needed to actually submit
-
-`AUR_SSH_KEY`, `GPG_PRIVATE_KEY`/`GPG_PASSPHRASE`, `CHOCOLATEY_API_KEY`,
-`PKG_SUBMIT_TOKEN` (for tap/bucket/winget-pkgs PRs). Until set, channels dry-run.
-
-## Bump a release
+## Build a single channel locally
 
 ```bash
-pnpm version:set 0.1.1            # sync all app/package versions
-git tag v0.1.1 && git push origin v0.1.1
-# release.yml builds + publishes; submit-packages.yml refreshes manifests
+bash apps/desktop/scripts/build-release.sh v0.1.1 linux   # tar.gz
+bash distribution/deb-rpm/build.sh v0.1.1                  # .deb + .rpm (needs nfpm)
+bash distribution/appimage/build.sh v0.1.1                # .AppImage
+node scripts/submit-packages.mjs -v 0.1.1 -p all --dry-run
 ```
+
+## Secrets to actually publish
+
+`AUR_SSH_KEY`, `GPG_PRIVATE_KEY`/`GPG_PASSPHRASE`, `CHOCOLATEY_API_KEY`,
+`SNAPCRAFT_STORE_CREDENTIALS`, `PKG_SUBMIT_TOKEN` (tap/bucket/winget-pkgs/Flathub
+PRs). Until set, channels dry-run.

distribution/appimage/build.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Build a universal-Linux AppImage from the linux release tarball.
+# Usage: distribution/appimage/build.sh <version>  (expects dist/tronbrowser-linux-x64.tar.gz)
+set -euo pipefail
+
+VERSION="${1:?usage: build.sh <version>}"
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TARBALL="$ROOT/dist/tronbrowser-linux-x64.tar.gz"
+[ -f "$TARBALL" ] || { echo "missing $TARBALL — run build-release.sh linux first" >&2; exit 1; }
+
+appdir="$(mktemp -d)/TronBrowser.AppDir"
+mkdir -p "$appdir/usr/lib" "$appdir/usr/bin"
+tar -xzf "$TARBALL" -C "$appdir/usr/lib"            # -> usr/lib/tronbrowser
+
+# AppRun -> the launcher.
+cat > "$appdir/AppRun" <<'EOF'
+#!/bin/sh
+HERE="$(dirname "$(readlink -f "$0")")"
+exec "$HERE/usr/lib/tronbrowser/tronbrowser" "$@"
+EOF
+chmod +x "$appdir/AppRun"
+
+cp "$HERE/tronbrowser.desktop" "$appdir/tronbrowser.desktop"
+if command -v rsvg-convert >/dev/null 2>&1; then
+  rsvg-convert -w 256 -h 256 "$ROOT/apps/web/public/favicon.svg" -o "$appdir/tronbrowser.png"
+else
+  cp "$ROOT/apps/web/public/favicon.svg" "$appdir/tronbrowser.svg"
+fi
+
+tool=/tmp/appimagetool
+[ -x "$tool" ] || curl -sSfL "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage" -o "$tool"
+chmod +x "$tool"
+ARCH=x86_64 "$tool" --appimage-extract-and-run "$appdir" "$ROOT/dist/TronBrowser-x86_64.AppImage"
+echo "built: $ROOT/dist/TronBrowser-x86_64.AppImage"

distribution/appimage/tronbrowser.desktop

@@ -0,0 +1,10 @@
+[Desktop Entry]
+Type=Application
+Name=TronBrowser
+GenericName=Web Browser
+Comment=Privacy-first, AI-native browser (Ungoogled Chromium fork)
+Exec=tron %u
+Icon=tronbrowser
+Terminal=false
+Categories=Network;WebBrowser;
+MimeType=text/html;x-scheme-handler/http;x-scheme-handler/https;

packaging/build-deb-rpm.sh distribution/deb-rpm/build.shpackaging/build-deb-rpm.sh renamed to distribution/deb-rpm/build.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
 # Build .deb and .rpm from the linux release tarball using nfpm.
-# Usage: build-deb-rpm.sh <version>   (expects dist/tronbrowser-linux-x64.tar.gz)
+# Usage: distribution/deb-rpm/build.sh <version>   (expects dist/tronbrowser-linux-x64.tar.gz)
 set -euo pipefail
 
-VERSION="${1:?usage: build-deb-rpm.sh <version>}"
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+VERSION="${1:?usage: build.sh <version>}"
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TARBALL="$ROOT/dist/tronbrowser-linux-x64.tar.gz"
 [ -f "$TARBALL" ] || { echo "missing $TARBALL — run build-release.sh linux first" >&2; exit 1; }
-
 command -v nfpm >/dev/null 2>&1 || { echo "nfpm not installed (https://nfpm.goreleaser.com)" >&2; exit 1; }
 
 work="$(mktemp -d)"
@@ -16,14 +16,12 @@ tar -xzf "$TARBALL" -C "$work"            # -> $work/tronbrowser
 TB_VERSION="${VERSION#v}"
 TB_ROOT="$work/tronbrowser"
 
-# Render the config (nfpm doesn't reliably expand env in contents.src globs).
 rendered="$work/nfpm.yaml"
 sed -e "s|\${TB_VERSION}|${TB_VERSION}|g" -e "s|\${TB_ROOT}|${TB_ROOT}|g" \
-  "$ROOT/packaging/nfpm.yaml" > "$rendered"
+  "$HERE/nfpm.yaml" > "$rendered"
 
 nfpm package -f "$rendered" -p deb -t "$ROOT/dist"
 nfpm package -f "$rendered" -p rpm -t "$ROOT/dist"
-
 rm -rf "$work"
 echo "built deb + rpm:"
 ls -lh "$ROOT/dist"/*.deb "$ROOT/dist"/*.rpm 2>/dev/null | awk '{print "  "$9" ("$5")"}'

packaging/nfpm.yaml distribution/deb-rpm/nfpm.yamlpackaging/nfpm.yaml renamed to distribution/deb-rpm/nfpm.yaml

@@ -0,0 +1,29 @@
+# Flatpak manifest. Build: flatpak-builder build dev.tronbrowser.TronBrowser.yml
+# Publish via Flathub PR. The launcher is sandboxed, so it uses flatpak-spawn to
+# run the host's Chromium (see the tron wrapper below).
+app-id: dev.tronbrowser.TronBrowser
+runtime: org.freedesktop.Platform
+runtime-version: '24.08'
+sdk: org.freedesktop.Sdk
+command: tron
+finish-args:
+  - --share=network
+  - --socket=wayland
+  - --socket=fallback-x11
+  - --device=dri
+  - --filesystem=home
+  # Allow running the host browser binary from inside the sandbox.
+  - --talk-name=org.freedesktop.Flatpak
+modules:
+  - name: tronbrowser
+    buildsystem: simple
+    build-commands:
+      - mkdir -p /app/lib/tronbrowser
+      - cp -r tronbrowser/. /app/lib/tronbrowser/
+      - install -Dm755 tron-wrapper /app/bin/tron
+    sources:
+      - type: archive
+        url: https://github.com/profullstack/tronbrowser.dev/releases/download/v0.1.1/tronbrowser-linux-x64.tar.gz
+        sha256: __SHA256_LINUX__
+      - type: file
+        path: tron-wrapper

distribution/flatpak/dev.tronbrowser.TronBrowser.yml

@@ -0,0 +1,4 @@
+#!/bin/sh
+# Flatpak entrypoint: the bundled launcher needs the HOST's Chromium, so run it
+# outside the sandbox via flatpak-spawn.
+exec flatpak-spawn --host /app/lib/tronbrowser/tronbrowser "$@"

distribution/flatpak/tron-wrapper

@@ -0,0 +1,29 @@
+# FreeBSD port — www/tronbrowser. Consumes the GitHub release tarball.
+PORTNAME=	tronbrowser
+DISTVERSION=	0.1.1
+CATEGORIES=	www
+
+MASTER_SITES=	https://github.com/profullstack/tronbrowser.dev/releases/download/v${DISTVERSION}/
+DISTNAME=	tronbrowser-linux-x64
+
+MAINTAINER=	security@profullstack.com
+COMMENT=	Privacy-first, AI-native browser (Ungoogled Chromium fork)
+WWW=		https://tronbrowser.dev
+
+LICENSE=	MIT
+LICENSE_FILE=	${WRKSRC}/LICENSE
+
+RUN_DEPENDS=	chrome:www/chromium
+
+NO_BUILD=	yes
+NO_ARCH=	yes
+WRKSRC=		${WRKDIR}/tronbrowser
+
+do-install:
+	@${MKDIR} ${STAGEDIR}${PREFIX}/lib/tronbrowser
+	(cd ${WRKSRC} && ${COPYTREE_SHARE} . ${STAGEDIR}${PREFIX}/lib/tronbrowser)
+	@${CHMOD} +x ${STAGEDIR}${PREFIX}/lib/tronbrowser/tronbrowser
+	${LN} -sf ${PREFIX}/lib/tronbrowser/tronbrowser ${STAGEDIR}${PREFIX}/bin/tron
+	${LN} -sf ${PREFIX}/lib/tronbrowser/tronbrowser ${STAGEDIR}${PREFIX}/bin/tronbrowser
+
+.include <bsd.port.mk>