build: export the app icon via --disable-sandbox instead of dropping it

flatpak build-export validates exported icons in a bwrap sandbox that
fails in an unprivileged CI container. The previous workaround stripped
build-dir/export/share/icons entirely, but flatpak exports the host icon
from that tree at install time, so the host menu and the window/alt-tab
icon were left generic on every machine - even ones where validation
would have passed.

Use 'flatpak build-export --disable-sandbox', which runs the same icon
validation in-process (no bwrap/userns) and keeps the icon in the export,
so it reaches the host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -19,9 +19,9 @@ repository on the `pages` branch of this repo. You add that as a Flatpak remote
 # Flathub provides the runtime O3DE needs
 flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
 
-# Add this repo (replace <owner> with the Gitea account that owns the repo)
+# Add this repo
 flatpak remote-add --if-not-exists o3de \
-  https://gitea.pc-heini.de/<owner>/o3de-flatpak/raw/branch/pages/o3de.flatpakrepo
+  https://git.pc-heini.de/pc-heini/o3de-flatpak/raw/branch/pages/o3de.flatpakrepo
 
 flatpak install o3de org.o3de.O3DE
 flatpak run org.o3de.O3DE
@@ -128,11 +128,11 @@ The first iteration publishes an unsigned repo for simplicity. To sign:
 
 ---
 
-## Caveats & things to verify
+## Caveats
 
-These were confirmed by inspecting the v26.05 package (`opt/O3DE/26.05/…`):
+These were confirmed by inspecting and running the v26.05 package (`opt/O3DE/26.05/…`):
 
-- **Layout is confirmed for now**: the package installs everything under
+- **Layout**: the package installs everything under
   `/opt/O3DE/<ver>/`, with the launcher at `bin/Linux/profile/Default/o3de` and
   ~270 `.so` files beside it (hence the wrapper's `LD_LIBRARY_PATH`). If a future
   release moves things, adjust `o3de-wrapper.sh` and the manifest.
@@ -180,11 +180,13 @@ These were confirmed by inspecting the v26.05 package (`opt/O3DE/26.05/…`):
   `--regset`. Real project data (projects you create, their caches) lives under
   your home directory and is fully writable, so actual work is unaffected.
 - **Launcher icon.** Shipped as `org.o3de.O3DE.png` (the `.deb` itself has only
-  in-editor asset icons). It's kept *inside* the app so the running window/taskbar
-  shows it, but removed from the *exported* set because `flatpak build-export`
-  validates exported icons in a bwrap sandbox that fails in an unprivileged
-  container. Consequence: the host menu launcher icon is generic. A privileged
-  runner would let us export it properly.
+  in-editor asset icons). `flatpak build-export` validates exported icons in a
+  bwrap sandbox that fails in an unprivileged container ("is not a valid icon:
+  bwrap …"), so the build exports with `--disable-sandbox`: the icon is still
+  validated, but in-process rather than via bwrap/userns. The icon is now
+  exported to the host, so the menu launcher shows it; the window/alt-tab icon
+  also picks it up as long as the compositor matches the window to the desktop
+  entry (`StartupWMClass=O3DE` must equal the window's `WM_CLASS`).
 - **GPU / drivers:** the renderer needs working GPU access. The manifest grants
   `--device=dri`/`--device=all`; on some setups you may also want the matching
   GPU driver extension from Flathub.

o3de.flatpakrepo

@@ -1,10 +1,9 @@
 [Flatpak Repo]
 Title=O3DE (unofficial Flatpak)
-# Replace <owner> with the Gitea account/org that owns this repo.
 # The CI job regenerates this file on the 'pages' branch with the correct URL,
 # so the canonical copy to use is:
-#   https://gitea.pc-heini.de/<owner>/o3de-flatpak/raw/branch/pages/o3de.flatpakrepo
-Url=https://gitea.pc-heini.de/<owner>/o3de-flatpak/raw/branch/pages
+#   https://git.pc-heini.de/pc-heini/o3de-flatpak/raw/branch/pages/o3de.flatpakrepo
+Url=https://git.pc-heini.de/pc-heini/o3de-flatpak/raw/branch/pages
 Homepage=https://o3de.org/
 Comment=Unofficial O3DE engine repackaged as a Flatpak
 Description=Install the Open 3D Engine on any Linux distribution via Flatpak.

scripts/make-flatpak.sh

@@ -84,12 +84,12 @@ flatpak build-finish build-dir \
 
 echo ">> export to OSTree repo"
 # flatpak build-export validates exported app icons in a bwrap sandbox, which
-# fails in an unprivileged container ("is not a valid icon: bwrap ..."). The
-# icon stays inside the app (so the running window/taskbar shows it); we just
-# drop it from the *exported* set so export skips validation. Trade-off: the
-# host menu launcher icon is generic. (A privileged runner would avoid this.)
-rm -rf build-dir/export/share/icons
-flatpak build-export repo build-dir "$BRANCH"
+# fails in an unprivileged container ("is not a valid icon: bwrap ..."). Rather
+# than drop the icon from the export (which left the host menu and the window /
+# alt-tab icon generic, because flatpak exports the host icon from this tree at
+# install time), --disable-sandbox runs the same icon validation in-process,
+# without bwrap. The icon is still validated; it just no longer needs userns.
+flatpak build-export --disable-sandbox repo build-dir "$BRANCH"
 flatpak build-update-repo repo --title="O3DE (unofficial Flatpak)" --prune --prune-depth=1
 
 echo ">> done: ./repo"