Public Access
ADR 0014 gave the phone a nightly and ADR 0013 rule 3 gave the desktop none, so the two heads had different answers to the same question — how does somebody try what is on main? — for no reason except the order the work happened in. This is the desktop's answer: CI publishes a build from main on every push, and it installs beside the release one rather than over it. The phone gets its separation from the platform. Android refuses an update signed by a different key, so its two channels cannot replace one another whatever anybody does. Nothing refuses anything here: Velopack applies what its feed serves and verifies no signature. So all of it is construction, and there are four separations because each closes a different door. A pack id each, so the two install in different directories and neither feed's package can be applied to the other's install. A Velopack channel each — win and win-nightly — so neither build ever reads the other's release index; the name reaches the wire as releases.win-nightly.json, which is why the constant in VelopackUpdateChannel and the argument in ci.yml have to agree or the channel answers nothing forever with no error. A prerelease flag, so the release channel cannot see the nightly even by accident. And a profile directory each, which is the one that is easy to skip and would hurt most: the cache schema is migrated on every launch, before unlock, so a shared profile means a nightly quietly upgrading a database the release build then opens. Both are installed at once by design, so that is an ordinary Tuesday rather than a corner case. The prerelease flag turns out to be load-bearing across heads as well. The phone's release channel reads releases/latest, which skips prereleases — so a desktop nightly published as a stable release would become the newest release in this repository and every phone on the release channel would start failing its check against a release carrying no Android manifest. Which build this is arrives as assembly metadata, the same mechanism and the same reasoning as the Android head: the updater needs the string rather than a branch, and a value baked into the assembly is one a crash report can be asked for. Three things read it — the feed, the prerelease flag, and the profile — and one more shows it: the titlebar says DodoSSH Nightly. Everything else that distinguishes the two is somewhere nobody is looking while typing a passphrase into one of them. The version needed a floor and it is applied to the whole build rather than to the packaging. MinVer answers 0.0.0-alpha.0.N until the first v* tag and vpk refuses anything below 0.0.1, so the job lifts the patch digit and keeps the height — through MinVerVersionOverride, so the assemblies carry the same number the installer does. Packing a version the assembly disagreed with would put one string on the preferences screen and another in the feed, which is the screen somebody reads when asked which nightly they are on. Two things found by running it rather than reading it. -t:MinVer needs a restore first, because the target arrives with the package and MSB4057 on a clean checkout reads like a typo in the workflow rather than a missing restore; the release script had the same gap and now restores before it reads. And vpk rejects an empty --packVersion loudly, which is how a broken version handoff announces itself rather than shipping a package called 1.0.0. Rule 3 is untouched. The release channel still has no job, no token and no runner, and the two channels cannot see each other. What a nightly costs is written where somebody reads it before installing one: whoever can write a release here can put a build on every nightly machine, which is fine for a build being tried and is not fine for a build holding somebody's infrastructure credentials. Verified by running the job's own steps against a clone in a Linux container: DodoSSH.Desktop.Nightly-win-nightly-Setup.exe, and an index naming pack id DodoSSH.Desktop.Nightly at 0.0.1-alpha.0.144. The upload itself is the one step not exercised — it needs a real forge and a write token, and check 16.10 is what walks the half no runner can.
171 lines
8.9 KiB
XML
171 lines
8.9 KiB
XML
<Project Sdk="Microsoft.NET.Sdk">
|
|
|
|
<PropertyGroup>
|
|
<OutputType>WinExe</OutputType>
|
|
<ApplicationManifest>app.manifest</ApplicationManifest>
|
|
<AvaloniaUseCompiledBindingsByDefault>true</AvaloniaUseCompiledBindingsByDefault>
|
|
|
|
<!--
|
|
The project is named for its layer and the executable is named for the product. Users see the
|
|
executable — in Task Manager, in a shortcut's target, in the SmartScreen dialog an unsigned
|
|
installer raises — and DodoSSH.Client.App.exe reads as an implementation detail leaking out.
|
|
|
|
Safe to change now and not later: it becomes the main executable recorded in every Velopack
|
|
package, and changing it after a release means the updater looks for an executable that is no
|
|
longer there. Nothing else depends on the name — no avares://DodoSSH.Client.App URI exists, the
|
|
window icon is the assembly-relative /Assets/dodossh.ico, and WindowsDeviceKeyStore names its
|
|
CNG key with a literal.
|
|
-->
|
|
<AssemblyName>DodoSSH</AssemblyName>
|
|
|
|
<!--
|
|
No RuntimeIdentifiers here, and that is the considered answer rather than an omission.
|
|
|
|
Declaring win-x64 is the obvious way to let a self-contained publish restore, and it was tried:
|
|
it works, and it also writes a net10.0/win-x64 target into the lock file of every project this
|
|
one references transitively — which includes DodoSSH.Contracts and DodoSSH.Crypto, which the
|
|
server builds too. The API's Dockerfile then restores those projects with no RID and locked
|
|
mode, and fails NU1004 on a lock file that has grown a runtime identifier the server knows
|
|
nothing about. The desktop head's packaging would have broken the server's image build.
|
|
|
|
So the RID stays out of the committed state entirely, and the publish that needs one asks for
|
|
it unlocked — see scripts/release-windows.ps1 and the CI step that proves the same thing. The
|
|
locked restore that gates every ordinary build is untouched, which is the property worth
|
|
keeping. See docs/platform-flags.md.
|
|
-->
|
|
|
|
<!--
|
|
The icon on the executable itself — what Explorer, the Start menu and a pinned taskbar button
|
|
draw, all of which read it from the PE resource and never start the process. Window.Icon in
|
|
MainWindow.axaml is a separate thing that only exists once the application is running; both are
|
|
needed, and both point at this file.
|
|
-->
|
|
<ApplicationIcon>Assets/dodossh.ico</ApplicationIcon>
|
|
|
|
<!--
|
|
============ WHICH CHANNEL THIS BUILD BELONGS TO ============
|
|
|
|
The same split the Android head has, for the same reason and with one difference worth stating up
|
|
front: Android gets separation for free, because the platform refuses an update signed by a
|
|
different key, so its two channels cannot replace one another whatever anybody does. Nothing
|
|
refuses anything here. Velopack applies what its feed serves, so the separation has to be built:
|
|
two pack ids, two Velopack channels, two feeds, and a profile directory each.
|
|
|
|
release — DodoSSH.Desktop, Velopack channel win, read from the newest non-prerelease release.
|
|
Cut from a v* tag by scripts/release-windows.ps1, by a person. See ADR 0013 rule 3.
|
|
nightly — DodoSSH.Desktop.Nightly, Velopack channel win-nightly, read from a prerelease release
|
|
CI replaces on every push to main.
|
|
|
|
Default release, so an unqualified `dotnet build` is the real application and the nightly is the
|
|
one you have to ask for.
|
|
|
|
What this property does *not* decide is the pack id or the title. Those are arguments to vpk and
|
|
live where the packaging happens — in ci.yml for the nightly and in the release script for the
|
|
release. Putting them here would suggest the build knows which package it will end up inside,
|
|
and it does not.
|
|
-->
|
|
<DodoChannel Condition="'$(DodoChannel)' == ''">release</DodoChannel>
|
|
|
|
<!--
|
|
False here, unlike every server project. The root Directory.Build.props sets it true because
|
|
the API is container-hosted, UTC-only and has no business formatting anything for a human.
|
|
This process does: it shows timestamps and host names to a person who expects their own
|
|
locale's conventions. Invariant globalization would quietly render every date in a format
|
|
that is correct for nobody.
|
|
-->
|
|
<InvariantGlobalization>false</InvariantGlobalization>
|
|
</PropertyGroup>
|
|
|
|
<ItemGroup>
|
|
<!--
|
|
Named rather than globbed as Assets/**, because the folder also holds the script that draws the
|
|
icon and a build has no reason to carry a copy of it around inside the binary.
|
|
-->
|
|
<AvaloniaResource Include="Assets/dodossh.ico" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<!--
|
|
Which channel this build belongs to, carried in the assembly the same way the Android head carries
|
|
it. Metadata rather than a compile-time constant for the reason stated there: the updater needs the
|
|
string rather than a branch, and a value baked into the assembly is one a crash report can be asked
|
|
for. See DesktopChannel, which is the only thing that reads it.
|
|
-->
|
|
<AssemblyMetadata Include="DodoChannel" Value="$(DodoChannel)" />
|
|
</ItemGroup>
|
|
|
|
<!--
|
|
Two native symbol files, and they are the reason a self-contained publish weighed 227 MB.
|
|
|
|
Measured on a win-x64 publish: libSkiaSharp.pdb is 80.1 MB and libHarfBuzzSharp.pdb is 19.9 MB, so
|
|
the two of them are 100 MB of debug symbols for third-party native code nobody here will ever step
|
|
through. Dropping them takes the publish to about 127 MB, which is most of what a first install
|
|
costs somebody on a slow connection.
|
|
|
|
Our own symbols stay, and the distinction is the point rather than a compromise. All fifteen managed
|
|
PDBs together are 0.93 MB, and with them present an Exception.ToString() carries file names and line
|
|
numbers — which for a self-hosted product is the whole diagnostic channel, because the way a fault
|
|
gets reported is a user pasting a stack into an issue.
|
|
|
|
Named one by one instead of matched by a pattern. A rule like "drop every .pdb whose assembly is
|
|
native" would be shorter and would silently start dropping ours the day a managed library ships a
|
|
file this heuristic misreads, and a build that quietly stops carrying line numbers is not a thing
|
|
anybody notices until they need them.
|
|
-->
|
|
<Target Name="DropNativeSymbolsFromPublish" AfterTargets="ComputeResolvedFilesToPublishList">
|
|
<ItemGroup>
|
|
<ResolvedFileToPublish
|
|
Remove="@(ResolvedFileToPublish)"
|
|
Condition="'%(Filename)%(Extension)' == 'libSkiaSharp.pdb'
|
|
or '%(Filename)%(Extension)' == 'libHarfBuzzSharp.pdb'" />
|
|
</ItemGroup>
|
|
</Target>
|
|
|
|
<ItemGroup>
|
|
<PackageReference Include="Avalonia" />
|
|
<PackageReference Include="Avalonia.Desktop" />
|
|
<PackageReference Include="Avalonia.Themes.Fluent" />
|
|
<PackageReference Include="Avalonia.Fonts.Inter" />
|
|
<PackageReference Include="Avalonia.Controls.WebView" />
|
|
<PackageReference Include="CommunityToolkit.Mvvm" />
|
|
<!--
|
|
Here and in no other project. The Android head must never reference it — that head's
|
|
distribution is settled by ADR 0011 and has no updater — and DodoSSH.Client.Shell is shared
|
|
between the two heads, so the one file that names Velopack lives in Platform/ beside
|
|
WindowsDeviceKeyStore, which is the same shape of thing: a Windows-only implementation of an
|
|
interface declared in DodoSSH.Client.Session.
|
|
-->
|
|
<PackageReference Include="Velopack" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<!--
|
|
The shell's view models, the terminal renderer's files and the palette, all shared with the Android
|
|
head. This project is now the desktop *views* and the desktop platform integration, and nothing else.
|
|
-->
|
|
<ProjectReference Include="../DodoSSH.Client.Shell/DodoSSH.Client.Shell.csproj" />
|
|
<ProjectReference Include="../DodoSSH.Client.Import/DodoSSH.Client.Import.csproj" />
|
|
<ProjectReference Include="../DodoSSH.Client.Session/DodoSSH.Client.Session.csproj" />
|
|
<ProjectReference Include="../DodoSSH.Client.Ssh/DodoSSH.Client.Ssh.csproj" />
|
|
<ProjectReference Include="../DodoSSH.Client.ObjectStore/DodoSSH.Client.ObjectStore.csproj" />
|
|
<ProjectReference Include="../DodoSSH.Client.Terminal/DodoSSH.Client.Terminal.csproj" />
|
|
<ProjectReference Include="../DodoSSH.Client.Transfer/DodoSSH.Client.Transfer.csproj" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<!--
|
|
The view models are plain CommunityToolkit.Mvvm objects and need no Avalonia to run, so the shell's
|
|
state machine is testable as ordinary code. That is the whole reason the sign-in step is a delegate.
|
|
-->
|
|
<InternalsVisibleTo Include="DodoSSH.Client.App.Tests" />
|
|
|
|
<!--
|
|
The layout harness needs the views and the application class themselves, not just the view models:
|
|
its whole job is to lay out the real XAML and measure it.
|
|
-->
|
|
<InternalsVisibleTo Include="DodoSSH.Client.App.Layout.Tests" />
|
|
</ItemGroup>
|
|
|
|
</Project>
|
|
|