chore: add release infrastructure and packaging support

Add GitHub Actions workflows for CI and release builds, packaging
scripts for Windows, macOS, Linux, and Flatpak/Snap distribution,
application icons, desktop files, and release metadata resources.

script/bundle-linux

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+# Function for displaying help info
+help_info() {
+  echo "
+Usage: ${0##*/}
+Build a release .tar.gz for Linux.
+"
+}
+
+# Parse all arguments manually
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -h|--help)
+            help_info
+            exit 0
+            ;;
+        --)
+            shift
+            break
+            ;;
+        -*)
+            echo "Unknown option: $1" >&2
+            help_info
+            exit 1
+            ;;
+        *)
+            echo "Error: Unexpected argument: $1" >&2
+            help_info
+            exit 1
+            ;;
+    esac
+done
+
+target_dir="${CARGO_TARGET_DIR:-target}"
+
+version="$(script/get-crate-version signed)"
+# Set RELEASE_VERSION so it's compiled into the app and it knows about the version.
+export RELEASE_VERSION="${version}"
+
+commit=$(git rev-parse HEAD | cut -c 1-7)
+
+version_info=$(rustc --version --verbose)
+host_line=$(echo "$version_info" | grep host)
+target_triple=${host_line#*: }
+
+export CC=$(which clang)
+
+# Build binary in release mode
+export RUSTFLAGS="${RUSTFLAGS:-} -C link-args=-Wl,--disable-new-dtags,-rpath,\$ORIGIN/../lib"
+cargo build --release --target "${target_triple}" --package signed
+
+# Strip debug symbols and save them
+objcopy --only-keep-debug "${target_dir}/${target_triple}/release/signed" "${target_dir}/${target_triple}/release/signed.dbg"
+objcopy --strip-debug "${target_dir}/${target_triple}/release/signed"
+
+gzip -f "${target_dir}/${target_triple}/release/signed.dbg"
+
+# Move everything that should end up in the final package
+# into a temp directory.
+temp_dir=$(mktemp -d)
+signed_dir="${temp_dir}/signed.app"
+
+# Binary
+mkdir -p "${signed_dir}/bin" "${signed_dir}/libexec"
+cp "${target_dir}/${target_triple}/release/signed" "${signed_dir}/libexec/signed"
+cp "${target_dir}/${target_triple}/release/signed" "${signed_dir}/bin/signed"
+
+# Libs
+find_libs() {
+    ldd ${target_dir}/${target_triple}/release/signed |\
+        cut -d' ' -f3 |\
+        grep -v '\<\(libstdc++.so\|libc.so\|libgcc_s.so\|libm.so\|libpthread.so\|libdl.so\|libasound.so\)'
+}
+
+mkdir -p "${signed_dir}/lib"
+rm -rf "${signed_dir}/lib/*"
+cp $(find_libs) "${signed_dir}/lib"
+
+# Icons
+mkdir -p "${signed_dir}/share/icons/hicolor/512x512/apps"
+cp "desktop/resources/icon.png" "${signed_dir}/share/icons/hicolor/512x512/apps/signed.png"
+mkdir -p "${signed_dir}/share/icons/hicolor/1024x1024/apps"
+cp "desktop/resources/icon@2x.png" "${signed_dir}/share/icons/hicolor/1024x1024/apps/signed.png"
+
+# .desktop
+export DO_STARTUP_NOTIFY="true"
+export APP_CLI="signed"
+export APP_ICON="signed"
+export APP_ARGS="%U"
+export APP_NAME="Signed"
+
+mkdir -p "${signed_dir}/share/applications"
+envsubst < "desktop/resources/signed.desktop.in" > "${signed_dir}/share/applications/signed.desktop"
+
+# Create archive out of everything that's in the temp directory
+arch=$(uname -m)
+target="linux-${arch}"
+archive="signed-${target}.tar.gz"
+
+rm -rf "${archive}"
+remove_match="signed(-[a-zA-Z0-9]+)?-linux-$(uname -m)\.tar\.gz"
+ls "${target_dir}/release" | grep -E ${remove_match} | xargs -d "\n" -I {} rm -f "${target_dir}/release/{}" || true
+tar -czvf "${target_dir}/release/$archive" -C ${temp_dir} "signed.app"

script/bundle-macos

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+# Build the macOS .app/.dmg bundle with cargo-packager.
+# Requires macOS. Linux/macOS users building on Windows are unsupported here.
+
+set -euxo pipefail
+cd "$(dirname "$0")/../desktop"
+
+if ! command -v cargo-packager >/dev/null 2>&1; then
+  cargo install cargo-packager --locked
+fi
+
+cargo packager --release

script/bundle-snap

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+if [ "$#" -ne 1 ]; then
+  echo "Usage: $0 <release_version>"
+  exit 1
+fi
+
+ARCH=$(uname -m)
+# Snap uses its own architecture names, which must match the file name and
+# the architecture asserted inside the .snap. `x86_64`/`aarch64` here would
+# produce a file like signed_1.0.0_x86_64.snap that snapd cannot match.
+case "$ARCH" in
+  x86_64|amd64) ARCH_SUFFIX="amd64" ;;
+  aarch64|arm64) ARCH_SUFFIX="arm64" ;;
+  *) echo "Unsupported architecture: $ARCH"; exit 1 ;;
+esac
+
+# Setup GUI files
+mkdir -p snap/gui
+export DO_STARTUP_NOTIFY="true"
+export APP_NAME="Signed"
+export APP_ICON="\${SNAP}/meta/gui/signed.png"
+export APP_ARGS="%U"
+envsubst < "desktop/resources/signed.desktop.in" > "snap/gui/signed.desktop"
+cp "desktop/resources/icon.png" "snap/gui/signed.png"
+
+# Generate snapcraft.yaml with version and architecture
+RELEASE_VERSION="$1" ARCH_SUFFIX="$ARCH_SUFFIX" envsubst < desktop/resources/snap/snapcraft.yaml.in > snap/snapcraft.yaml
+
+# Clean previous builds
+snapcraft clean
+
+# Build snap with architecture in filename
+SNAP_NAME="signed_${1}_${ARCH_SUFFIX}.snap"
+snapcraft --destructive-mode --output "$SNAP_NAME"
+
+echo "Created snap package: $SNAP_NAME"
+cat <<'EOF'
+
+Install locally (local builds are unsigned, so snapd requires --dangerous; a
+plain `snap install ./file.snap` fails with "cannot find signatures with
+metadata for snap/component ..."):
+
+  sudo snap install --dangerous ./signed_<version>_amd64.snap
+
+Distribute publicly via the Snap Store (signs the snap, users can then run
+plain `snap install signed`):
+
+  snapcraft login
+  snapcraft upload ./signed_<version>_amd64.snap
+  snapcraft release signed <uploaded-revision> stable
+EOF

script/bundle-windows

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+# Build the Windows .msi/.exe bundles with cargo-packager.
+# Requires Windows (MSVC toolchain) - run from Git Bash or MSYS2.
+
+set -euxo pipefail
+cd "$(dirname "$0")/../desktop"
+
+if ! command -v cargo-packager >/dev/null 2>&1; then
+  cargo install cargo-packager --locked
+fi
+
+cargo packager --release

script/flatpak/bundle-flatpak

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+cd "$(dirname "$0")/../.."
+shopt -s extglob
+
+# Get system architecture
+ARCH=$(uname -m)
+case "$ARCH" in
+  x86_64) ARCH_SUFFIX="x86_64" ;;
+  aarch64) ARCH_SUFFIX="aarch64" ;;
+  *) echo "Unsupported architecture: $ARCH"; exit 1 ;;
+esac
+
+archive_match="signed(-[a-zA-Z0-9]+)?-linux-${ARCH_SUFFIX}\.tar\.gz"
+archive=$(ls "target/release" | grep -E ${archive_match})
+
+export ARCHIVE="$archive"
+export APP_ID="su.reya.signed"
+export APP_NAME="Signed"
+export BRANDING_LIGHT="#C6FF4D"
+export BRANDING_DARK="#C6FF4D"
+export ICON_FILE="icon"
+export CHANNEL="stable"
+
+# Generate manifest
+envsubst < "desktop/resources/flatpak/manifest-template.json" > "$APP_ID.json"
+
+# Build Flatpak
+flatpak-builder --user --install --force-clean build "$APP_ID.json"
+
+# Create bundle with architecture suffix
+OUTPUT_FILE="target/release/${APP_ID}_${ARCH_SUFFIX}.flatpak"
+flatpak build-bundle ~/.local/share/flatpak/repo "$OUTPUT_FILE" "$APP_ID"
+echo "Created '$OUTPUT_FILE'"

script/flatpak/deps

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+flatpak remote-add --if-not-exists --user flathub https://dl.flathub.org/repo/flathub.flatpakrepo
+
+arch=$(arch)
+fd_version=24.08
+flatpak install -y --user org.freedesktop.Platform/${arch}/${fd_version}
+flatpak install -y --user org.freedesktop.Sdk/${arch}/${fd_version}
+flatpak install -y --user org.freedesktop.Sdk.Extension.rust-stable/${arch}/${fd_version}

script/get-crate-version

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -eu
+
+if [[ $# -ne 1 ]]; then
+  echo "Usage: $0 <crate_name>" >&2
+  exit 1
+fi
+
+CRATE_NAME=$1
+
+cargo metadata \
+    --no-deps \
+    --format-version=1 \
+    | jq \
+        --raw-output \
+        ".packages[] | select(.name == \"${CRATE_NAME}\") | .version"

script/linux

@@ -0,0 +1,238 @@
+#!/usr/bin/env bash
+
+set -xeuo pipefail
+
+# if root or if sudo/unavailable, define an empty variable
+if [ "$(id -u)" -eq 0 ]
+then maysudo=''
+else maysudo="$(command -v sudo || command -v doas || true)"
+fi
+
+function finalize {
+  # after packages install (curl, etc), get the rust toolchain
+  which rustup > /dev/null 2>&1 || curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+  # verify the mold situation
+  if ! command -v mold >/dev/null 2>&1; then
+    echo "Warning: Mold binaries are unavailable on your system." >&2
+    echo "    Builds will be slower without mold. Try: script/install-mold" >&2
+  fi
+  echo "Finished installing Linux dependencies with script/linux"
+}
+
+# Ubuntu, Debian, Mint, Kali, Pop!_OS, Raspbian, etc.
+apt=$(command -v apt-get || true)
+if [[ -n $apt ]]; then
+  deps=(
+    gcc
+    g++
+    libasound2-dev
+    libfontconfig-dev
+    libwayland-dev
+    libx11-xcb-dev
+    libxkbcommon-x11-dev
+    libssl-dev
+    libzstd-dev
+    libvulkan1
+    libgit2-dev
+    libx11-dev
+    make
+    cmake
+    clang
+    jq
+    git
+    curl
+    gettext-base
+    elfutils
+    musl-tools
+    musl-dev
+    build-essential
+  )
+  if (grep -qP 'PRETTY_NAME="(Linux Mint 22|.+24\.(04|10))' /etc/os-release); then
+    deps+=( mold libstdc++-14-dev )
+  elif (grep -qP 'PRETTY_NAME="((Debian|Raspbian).+12|Linux Mint 21|.+22\.04)' /etc/os-release); then
+    deps+=( mold libstdc++-12-dev )
+  elif (grep -qP 'PRETTY_NAME="((Debian|Raspbian).+11|Linux Mint 20|.+20\.04)' /etc/os-release); then
+    deps+=( libstdc++-10-dev )
+  fi
+
+  $maysudo "$apt" update
+  $maysudo "$apt" install -y "${deps[@]}"
+  finalize
+  exit 0
+fi
+
+# Fedora, CentOS, RHEL, Alma, Amazon 2023, Oracle, etc.
+dnf=$(command -v dnf || true)
+# Old Redhat (yum only): Amazon Linux 2, Oracle Linux 7, etc.
+yum=$(command -v yum || true)
+
+if [[ -n $dnf ]] || [[ -n $yum ]]; then
+  pkg_cmd="${dnf:-${yum}}"
+  deps=(
+    musl-gcc
+    gcc
+    clang
+    cmake
+    alsa-lib-devel
+    fontconfig-devel
+    wayland-devel
+    libxcb-devel
+    libxkbcommon-x11-devel
+    openssl-devel
+    libzstd-devel
+    vulkan-loader
+    jq
+    git
+    tar
+  )
+  # perl used for building openssl-sys crate. See: https://docs.rs/openssl/latest/openssl/
+  if grep -qP '^ID="?(fedora)' /etc/os-release; then
+    deps+=(
+      perl-FindBin
+      perl-IPC-Cmd
+      perl-File-Compare
+      perl-File-Copy
+      mold
+    )
+  elif grep -qP '^ID="?(rhel|rocky|alma|centos|ol)' /etc/os-release; then
+    deps+=( perl-interpreter )
+  fi
+
+  # gcc-c++ is g++ on RHEL8 and 8.x clones
+  if grep -qP '^ID="?(rhel|rocky|alma|centos|ol)' /etc/os-release \
+      && grep -qP '^VERSION_ID="?(8)' /etc/os-release; then
+    deps+=( gcc-c++ )
+  else
+    deps+=( g++ )
+  fi
+
+  # libxkbcommon-x11-devel is in a non-default repo on RHEL 8.x/9.x (except on AmazonLinux)
+  if grep -qP '^VERSION_ID="?(8|9)' /etc/os-release && grep -qP '^ID="?(rhel|rocky|centos|alma|ol)' /etc/os-release; then
+    $maysudo dnf install -y 'dnf-command(config-manager)'
+    if grep -qP '^PRETTY_NAME="(AlmaLinux 8|Rocky Linux 8)' /etc/os-release; then
+      $maysudo dnf config-manager --set-enabled powertools
+    elif grep -qP '^PRETTY_NAME="((AlmaLinux|Rocky|CentOS Stream) 9|Red Hat.+(8|9))' /etc/os-release; then
+      $maysudo dnf config-manager --set-enabled crb
+    elif grep -qP '^PRETTY_NAME="Oracle Linux Server 8' /etc/os-release; then
+      $maysudo dnf config-manager --set-enabled ol8_codeready_builder
+    elif grep -qP '^PRETTY_NAME="Oracle Linux Server 9' /etc/os-release; then
+      $maysudo dnf config-manager --set-enabled ol9_codeready_builder
+    else
+      echo "Unexpected distro" && grep 'PRETTY_NAME' /etc/os-release && exit 1
+    fi
+  fi
+
+  $maysudo "$pkg_cmd" install -y "${deps[@]}"
+  finalize
+  exit 0
+fi
+
+# openSUSE
+# https://software.opensuse.org/
+zyp=$(command -v zypper || true)
+if [[ -n $zyp ]]; then
+  deps=(
+    alsa-devel
+    clang
+    cmake
+    fontconfig-devel
+    gcc
+    gcc-c++
+    git
+    gzip
+    jq
+    libvulkan1
+    libx11-devel
+    libxcb-devel
+    libxkbcommon-devel
+    libxkbcommon-x11-devel
+    libzstd-devel
+    make
+    mold
+    openssl-devel
+    tar
+    wayland-devel
+    xcb-util-devel
+  )
+  $maysudo "$zyp" install -y "${deps[@]}"
+  finalize
+  exit 0
+fi
+
+# Arch, Manjaro, etc.
+# https://archlinux.org/packages
+pacman=$(command -v pacman || true)
+if [[ -n $pacman ]]; then
+  deps=(
+    gcc
+    clang
+    musl
+    cmake
+    alsa-lib
+    fontconfig
+    wayland
+    libgit2
+    libxcb
+    libxkbcommon-x11
+    openssl
+    zstd
+    pkgconf
+    mold
+    jq
+    git
+  )
+  $maysudo "$pacman" -Syu --needed --noconfirm "${deps[@]}"
+  finalize
+  exit 0
+fi
+
+# Void
+# https://voidlinux.org/packages/
+xbps=$(command -v xbps-install || true)
+if [[ -n $xbps ]]; then
+  deps=(
+    gettext-devel
+    clang
+    cmake
+    jq
+    elfutils-devel
+    gcc
+    alsa-lib-devel
+    fontconfig-devel
+    libxcb-devel
+    libxkbcommon-devel
+    libzstd-devel
+    openssl-devel
+    wayland-devel
+    vulkan-loader
+    mold
+  )
+  $maysudo "$xbps" -Syu "${deps[@]}"
+  finalize
+  exit 0
+fi
+
+# Gentoo
+# https://packages.gentoo.org/
+emerge=$(command -v emerge || true)
+if [[ -n $emerge ]]; then
+  deps=(
+    app-arch/zstd
+    app-misc/jq
+    dev-libs/openssl
+    dev-libs/wayland
+    dev-util/cmake
+    media-libs/alsa-lib
+    media-libs/fontconfig
+    media-libs/vulkan-loader
+    x11-libs/libxcb
+    x11-libs/libxkbcommon
+    sys-devel/mold
+  )
+  $maysudo "$emerge" -u "${deps[@]}"
+  finalize
+  exit 0
+fi
+
+echo "Unsupported Linux distribution in script/linux"
+exit 1

script/macos

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+set -xeuo pipefail
+
+export HOMEBREW_NO_INSTALL_CLEANUP=1
+
+# if root or if sudo/unavailable, define an empty variable
+if [ "$(id -u)" -eq 0 ]
+then maysudo=''
+else maysudo="$(command -v sudo || command -v doas || true)"
+fi
+
+function finalize {
+  # after packages install (curl, etc), get the rust toolchain
+  which rustup > /dev/null 2>&1 || curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+  # verify the mold situation
+  if ! command -v mold >/dev/null 2>&1; then
+    echo "Warning: Mold binaries are unavailable on your system." >&2
+    echo "    Builds will be slower without mold. Try: script/install-mold" >&2
+  fi
+  echo "Finished installing MacOS dependencies with script/macos"
+}
+
+# MacOS
+brew=$(command -v brew || true)
+if [[ -n $brew ]]; then
+  deps=(
+    gcc
+    libx11
+    libxkbcommon
+    openssl
+    zstd
+    vulkan-headers
+    libgit2
+    libx11
+    make
+    cmake
+    jq
+    git
+    curl
+    gettext
+  )
+
+  $brew update
+  for dep in "${deps[@]}";do
+  $brew search "$dep";
+  done
+  $brew install "${deps[@]}"
+  finalize
+  exit 0
+fi

script/prepare-flathub

@@ -0,0 +1,246 @@
+#!/usr/bin/env bash
+#
+# Prepare Flathub submission for Signed
+# This script:
+# 1. Vendors all Rust dependencies (crates.io + git)
+# 2. Generates release info for metainfo.xml
+# 3. Creates the Flathub manifest (su.reya.signed.yml)
+#
+# Usage: ./script/prepare-flathub [--release-date YYYY-MM-DD]
+
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+# Configuration
+APP_ID="su.reya.signed"
+APP_NAME="Signed"
+REPO_URL="https://git.reya.su/reya/signed"
+BRANDING_LIGHT="#C6FF4D"
+BRANDING_DARK="#C6FF4D"
+
+# Parse arguments
+RELEASE_DATE=""
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --release-date)
+            RELEASE_DATE="$2"
+            shift 2
+            ;;
+        -h|--help)
+            echo "Usage: ${0##*/} [options]"
+            echo ""
+            echo "Options:"
+            echo "  --release-date DATE    Release date in YYYY-MM-DD format (default: today)"
+            echo "  -h, --help            Display this help and exit"
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            exit 1
+            ;;
+    esac
+done
+
+# Get version from workspace
+VERSION=$(script/get-crate-version signed)
+if [[ -z "$RELEASE_DATE" ]]; then
+    RELEASE_DATE=$(date +%Y-%m-%d)
+fi
+
+echo "=== Preparing Flathub submission for $APP_NAME v$VERSION ==="
+echo ""
+
+# Create flathub directory
+mkdir -p flathub
+echo "[1/5] Created flathub/ directory"
+
+# Step 2: Vendor all dependencies
+echo "[2/5] Vendoring Rust dependencies..."
+if [[ -d vendor ]]; then
+    echo "      Removing old vendor directory..."
+    rm -rf vendor
+fi
+
+# Create cargo config for vendoring
+mkdir -p .cargo
+cat > .cargo/config.toml << 'EOF'
+[source.crates-io]
+replace-with = "vendored"
+
+[source.vendored]
+directory = "vendor"
+EOF
+
+# Vendor all dependencies (crates.io + git)
+cargo vendor --locked vendor/
+echo "      Vendored dependencies to vendor/"
+
+# Create tarball of vendored deps
+tar -czf flathub/vendor.tar.gz vendor/
+echo "      Created flathub/vendor.tar.gz"
+
+# Step 3: Generate release info for metainfo
+echo "[3/5] Generating release info..."
+cat > flathub/release-info.xml << EOF
+<release version="${VERSION}" date="${RELEASE_DATE}">
+  <description>
+    <p>Release version ${VERSION}</p>
+  </description>
+</release>
+EOF
+echo "      Created flathub/release-info.xml"
+
+# Step 4: Generate the metainfo file with release info
+echo "[4/5] Generating metainfo.xml..."
+export APP_ID APP_NAME BRANDING_LIGHT BRANDING_DARK
+cat desktop/resources/flatpak/signed.metainfo.xml.in | \
+    sed -e "/@release_info@/r flathub/release-info.xml" -e '/@release_info@/d' \
+    > flathub/${APP_ID}.metainfo.xml
+echo "      Created flathub/${APP_ID}.metainfo.xml"
+
+# Step 5: Generate the Flatpak manifest
+echo "[5/5] Generating Flatpak manifest..."
+
+# Get current commit hash
+COMMIT=$(git rev-parse HEAD)
+
+# Generate the YAML manifest
+cat > flathub/${APP_ID}.yml << 'MANIFEST_EOF'
+id: su.reya.signed
+runtime: org.freedesktop.Platform
+runtime-version: "24.08"
+sdk: org.freedesktop.Sdk
+sdk-extensions:
+  - org.freedesktop.Sdk.Extension.rust-stable
+  - org.freedesktop.Sdk.Extension.llvm18
+command: signed
+finish-args:
+  - --talk-name=org.freedesktop.Flatpak
+  - --device=dri
+  - --share=ipc
+  - --share=network
+  - --socket=wayland
+  - --socket=fallback-x11
+  - --socket=pulseaudio
+  - --filesystem=host
+
+build-options:
+  append-path: /usr/lib/sdk/rust-stable/bin:/usr/lib/sdk/llvm18/bin
+  env:
+    CC: clang
+    CXX: clang++
+
+modules:
+  - name: signed
+    buildsystem: simple
+    build-options:
+      env:
+        CARGO_HOME: /run/build/signed/cargo
+        CARGO_NET_OFFLINE: "true"
+        RELEASE_VERSION: "@VERSION@"
+    build-commands:
+      # Setup vendored dependencies
+      - mkdir -p .cargo
+      - cp cargo-config.toml .cargo/config.toml
+
+      # Extract vendored deps
+      - tar -xzf vendor.tar.gz
+
+      # Build the project (entire workspace, then install signed binary)
+      - cargo build --release --offline --package signed
+
+      # Install binary
+      - install -Dm755 target/release/signed /app/bin/signed
+
+      # Install icons
+      - install -Dm644 desktop/resources/icon.png /app/share/icons/hicolor/512x512/apps/su.reya.signed.png
+      - install -Dm644 desktop/resources/icon@2x.png /app/share/icons/hicolor/1024x1024/apps/su.reya.signed.png
+
+      # Install desktop file
+      - |
+        export APP_ID="su.reya.signed"
+        export APP_ICON="su.reya.signed"
+        export APP_NAME="Signed"
+        export APP_CLI="signed"
+        export APP_ARGS="%U"
+        export DO_STARTUP_NOTIFY="true"
+        envsubst < desktop/resources/signed.desktop.in > signed.desktop
+        install -Dm644 signed.desktop /app/share/applications/su.reya.signed.desktop
+
+      # Install metainfo (use pre-generated one with release info)
+      - install -Dm644 su.reya.signed.metainfo.xml /app/share/metainfo/su.reya.signed.metainfo.xml
+
+    sources:
+      # Main source code - specific commit
+      - type: git
+        url: https://git.reya.su/reya/signed.git
+        commit: "@COMMIT@"
+        tag: "v@VERSION@"
+
+      # Vendored dependencies tarball (generated by this script)
+      - type: file
+        path: vendor.tar.gz
+        sha256: "@VENDOR_SHA256@"
+
+      # Pre-generated metainfo with release info
+      - type: file
+        path: su.reya.signed.metainfo.xml
+        sha256: "@METAINFO_SHA256@"
+
+      # Cargo config for vendoring
+      - type: file
+        path: cargo-config.toml
+        sha256: "@CARGO_CONFIG_SHA256@"
+MANIFEST_EOF
+
+# Calculate SHA256 hashes
+VENDOR_SHA256=$(sha256sum flathub/vendor.tar.gz | cut -d' ' -f1)
+METAINFO_SHA256=$(sha256sum flathub/${APP_ID}.metainfo.xml | cut -d' ' -f1)
+
+# Create cargo-config.toml
+mkdir -p flathub
+cat > flathub/cargo-config.toml << 'EOF'
+[source.crates-io]
+replace-with = "vendored"
+
+[source.vendored]
+directory = "vendor"
+EOF
+CARGO_CONFIG_SHA256=$(sha256sum flathub/cargo-config.toml | cut -d' ' -f1)
+
+# Substitute values into the manifest
+sed -i.bak \
+    -e "s/@VERSION@/${VERSION}/g" \
+    -e "s/@COMMIT@/${COMMIT}/g" \
+    -e "s/@VENDOR_SHA256@/${VENDOR_SHA256}/g" \
+    -e "s/@METAINFO_SHA256@/${METAINFO_SHA256}/g" \
+    -e "s/@CARGO_CONFIG_SHA256@/${CARGO_CONFIG_SHA256}/g" \
+    flathub/${APP_ID}.yml
+rm -f flathub/${APP_ID}.yml.bak
+
+echo "      Created flathub/${APP_ID}.yml"
+
+echo ""
+echo "=== Flathub preparation complete! ==="
+echo ""
+echo "Files generated in flathub/:"
+echo "  - ${APP_ID}.yml           # Main Flatpak manifest (submit this to Flathub)"
+echo "  - ${APP_ID}.metainfo.xml  # AppStream metadata with release info"
+echo "  - vendor.tar.gz           # Vendored Rust dependencies"
+echo "  - cargo-config.toml       # Cargo configuration for vendoring"
+echo "  - release-info.xml        # Release info snippet"
+echo ""
+echo "Next steps:"
+echo "  1. Test the build locally:"
+echo "       cd flathub && flatpak-builder --user --install --force-clean build ${APP_ID}.yml"
+echo ""
+echo "  2. If build succeeds, submit to Flathub:"
+echo "     - Fork https://github.com/flathub/flathub"
+echo "     - Clone: git clone --branch=new-pr git@github.com:YOUR_USERNAME/flathub.git"
+echo "     - Copy ONLY ${APP_ID}.yml to the repo"
+echo "     - Submit PR against flathub/flathub:new-pr"
+echo ""
+echo "Note: Make sure you have:"
+echo "  - Committed all changes (commit: ${COMMIT})"
+echo "  - Tagged the release (tag: v${VERSION})"
+echo "  - Pushed the tag"

script/release

@@ -0,0 +1,132 @@
+#!/bin/bash
+
+# Script to release a new version of the application
+# Usage: ./release <new_version>
+
+set -e  # Exit on any error
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $0 <new_version>"
+    echo "Example: $0 1.0.0"
+    exit 1
+fi
+
+NEW_VERSION="$1"
+WORKSPACE_CARGO="Cargo.toml"
+CRATE_CARGO="desktop/Cargo.toml"
+
+# Check if both Cargo.toml files exist
+if [ ! -f "$WORKSPACE_CARGO" ]; then
+    echo "Error: $WORKSPACE_CARGO not found in current directory"
+    exit 1
+fi
+
+if [ ! -f "$CRATE_CARGO" ]; then
+    echo "Error: $CRATE_CARGO not found"
+    exit 1
+fi
+
+# Function to update version in a Cargo.toml file
+update_version() {
+    local file="$1"
+    local backup="${file}.bak"
+
+    # Backup the original file
+    cp "$file" "$backup"
+
+    # More flexible regex that handles various version formats and whitespace.
+    # Note: -i.bak works on both GNU and BSD sed.
+    if sed -i.bak -E "s/^[[:space:]]*version[[:space:]]*=[[:space:]]*\"[^\"]+\"/version = \"$NEW_VERSION\"/" "$file"; then
+        echo "✓ Updated version to $NEW_VERSION in $file"
+    else
+        echo "Error: Failed to update version in $file"
+        # Restore original backup
+        mv "$backup" "$file"
+        exit 1
+    fi
+
+    # Remove the backup file
+    rm -f "$backup"
+}
+
+# Update both Cargo.toml files
+echo "Updating versions..."
+update_version "$WORKSPACE_CARGO"
+update_version "$CRATE_CARGO"
+
+# Check git status before committing
+echo "Checking git status..."
+if git status --porcelain | grep -q .; then
+    echo "Current uncommitted changes:"
+    git status --short
+
+    # Ask user if they want to commit all changes or just version files
+    echo ""
+    echo "Do you want to:"
+    echo "1) Commit all current changes (including the version updates)"
+    echo "2) Commit only the version file changes"
+    echo "3) Abort the release"
+    read -p "Enter choice (1/2/3): " choice
+
+    case $choice in
+        1)
+            echo "Committing all changes..."
+            git add .
+            ;;
+        2)
+            echo "Committing only version file changes..."
+            git add "$WORKSPACE_CARGO" "$CRATE_CARGO"
+            ;;
+        3)
+            echo "Release aborted by user"
+            exit 0
+            ;;
+        *)
+            echo "Invalid choice. Release aborted."
+            exit 1
+            ;;
+    esac
+else
+    # Only version files were modified, add them specifically
+    echo "Only version files were modified, adding them for commit..."
+    git add "$WORKSPACE_CARGO" "$CRATE_CARGO"
+fi
+
+# Commit the changes
+COMMIT_MSG="chore: release version $NEW_VERSION"
+
+if git commit -m "$COMMIT_MSG"; then
+    echo "✓ Committed version changes"
+else
+    echo "Error: Failed to commit version changes"
+    exit 1
+fi
+
+# Push version changes to origin
+echo "Pushing version changes to origin..."
+if git push origin master; then
+    echo "✓ Successfully pushed version changes to origin"
+else
+    echo "Error: Failed to push version changes to origin"
+    exit 1
+fi
+
+# Create git tag
+TAG_NAME="v$NEW_VERSION"
+
+if git tag -a "$TAG_NAME" -m "$COMMIT_MSG"; then
+    echo "✓ Created git tag: $TAG_NAME"
+else
+    echo "Error: Failed to create git tag"
+    exit 1
+fi
+
+# Push tag to origin
+echo "Pushing tag to origin..."
+if git push origin "$TAG_NAME"; then
+    echo "✓ Successfully pushed tag to origin"
+    echo "✓ Release $NEW_VERSION completed successfully!"
+else
+    echo "Error: Failed to push tag to origin"
+    exit 1
+fi

script/try-snap

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+# This script is intended to be run after `script/bundle-snap`.
+#
+# It expects a version to be passed as the first argument, and expects the
+# built `.snap` for that version to be in the current directory. bundle-snap
+# names it `signed_<version>_amd64.snap` (Snap's canonical amd64/arm64 naming).
+#
+# This will uninstall the current `signed` snap, replacing it with a snap
+# that directly uses the `snap/unpacked` directory.
+
+set -euxo pipefail
+
+if [ "$#" -ne 1 ]; then
+  echo "Usage: $0 <release_version>"
+  exit 1
+fi
+
+# Rerun as root
+[ "$UID" -eq 0 ] || exec sudo bash -e "$0" "$@"
+
+snap remove signed || true
+mkdir -p snap
+rm -rf snap/unpacked
+unsquashfs -dest snap/unpacked "signed_$1_amd64.snap"
+snap try --classic snap/unpacked