From c1393383ba1fb7a910062e7c7857ce5de5ee6cb5 Mon Sep 17 00:00:00 2001 From: pc-heini Date: Tue, 16 Jun 2026 05:32:29 +0200 Subject: [PATCH] build: export the app icon via --disable-sandbox instead of dropping it flatpak build-export validates exported icons in a bwrap sandbox that fails in an unprivileged CI container. The previous workaround stripped build-dir/export/share/icons entirely, but flatpak exports the host icon from that tree at install time, so the host menu and the window/alt-tab icon were left generic on every machine - even ones where validation would have passed. Use 'flatpak build-export --disable-sandbox', which runs the same icon validation in-process (no bwrap/userns) and keeps the icon in the export, so it reaches the host. Co-Authored-By: Claude Opus 4.8 --- README.md | 12 +++++++----- scripts/make-flatpak.sh | 12 ++++++------ 2 files changed, 13 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 900ff848..ba116472 100644 --- a/README.md +++ b/README.md @@ -180,11 +180,13 @@ These were confirmed by inspecting and running the v26.05 package (`opt/O3DE/26. `--regset`. Real project data (projects you create, their caches) lives under your home directory and is fully writable, so actual work is unaffected. - **Launcher icon.** Shipped as `org.o3de.O3DE.png` (the `.deb` itself has only - in-editor asset icons). It's kept *inside* the app so the running window/taskbar - shows it, but removed from the *exported* set because `flatpak build-export` - validates exported icons in a bwrap sandbox that fails in an unprivileged - container. Consequence: the host menu launcher icon is generic. A privileged - runner would let us export it properly. + in-editor asset icons). `flatpak build-export` validates exported icons in a + bwrap sandbox that fails in an unprivileged container ("is not a valid icon: + bwrap …"), so the build exports with `--disable-sandbox`: the icon is still + validated, but in-process rather than via bwrap/userns. The icon is now + exported to the host, so the menu launcher shows it; the window/alt-tab icon + also picks it up as long as the compositor matches the window to the desktop + entry (`StartupWMClass=O3DE` must equal the window's `WM_CLASS`). - **GPU / drivers:** the renderer needs working GPU access. The manifest grants `--device=dri`/`--device=all`; on some setups you may also want the matching GPU driver extension from Flathub. diff --git a/scripts/make-flatpak.sh b/scripts/make-flatpak.sh index 2ce9eec3..d93ed3ed 100755 --- a/scripts/make-flatpak.sh +++ b/scripts/make-flatpak.sh @@ -84,12 +84,12 @@ flatpak build-finish build-dir \ echo ">> export to OSTree repo" # flatpak build-export validates exported app icons in a bwrap sandbox, which -# fails in an unprivileged container ("is not a valid icon: bwrap ..."). The -# icon stays inside the app (so the running window/taskbar shows it); we just -# drop it from the *exported* set so export skips validation. Trade-off: the -# host menu launcher icon is generic. (A privileged runner would avoid this.) -rm -rf build-dir/export/share/icons -flatpak build-export repo build-dir "$BRANCH" +# fails in an unprivileged container ("is not a valid icon: bwrap ..."). Rather +# than drop the icon from the export (which left the host menu and the window / +# alt-tab icon generic, because flatpak exports the host icon from this tree at +# install time), --disable-sandbox runs the same icon validation in-process, +# without bwrap. The icon is still validated; it just no longer needs userns. +flatpak build-export --disable-sandbox repo build-dir "$BRANCH" flatpak build-update-repo repo --title="O3DE (unofficial Flatpak)" --prune --prune-depth=1 echo ">> done: ./repo"