BifrOSt RÚV

org.bifrost.Ruv is an Icelandic-first television application built natively for COSMIC with Rust and libcosmic. It presents RÚV news, video on demand, search, television schedules, and the RÚV and RÚV 2 live streams in a remote-control-friendly interface. English is available as a complete fallback.

Features

• Icelandic-first Aðalskjár, Live, Guide, On demand, and Search navigation with a complete English fallback.
• RÚV RSS news and article reading, GraphQL programme shelves and episode details, dated RÚV/RÚV 2 schedules, and combined programme/news search.
• Responsive one-to-four-column layouts with uncropped 16:9 WebP artwork and at most four concurrent image downloads.
• RÚV and RÚV 2 HTTPS HLS playback with play/pause, replay, ±10-second seek, timeline, volume, mute, fullscreen, and keyboard controls.
• Independent 640×360 RÚV and RÚV 2 live frames, shown side by side on wide viewports and refreshed every minute without starting audible playback.
• The official square RÚV icon at 32, 64, 128, 256, and 512 pixel sizes.

This is an independent client. RÚV owns its names, programming, editorial content, imagery, streams, and trademarks; BifrOSt and this application are not affiliated with or endorsed by RÚV. The application icon uses the official square RÚV logo from RÚV’s public brand-assets page.

Data and sandbox

The application reads public RÚV RSS, GraphQL, search, image, and HTTPS media endpoints. Article HTML is converted to plain readable text before display. Playback uses iced_video_player with a GStreamer playbin3 pipeline compatible with the current streams-aware HLS demuxer. The live resolver may return short-lived *.cdn.ruv.is hosts; the media policy accepts that RÚV-owned suffix and the two exact RÚV Akamai tenants, while rejecting unrelated origins.

Origin policy for HLS is enforced on the top-level resolved manifest URL only: the address handed to the pipeline is validated against the media allowlist, after which GStreamer resolves child playlists, media segments, and encryption keys autonomously without re-entering that check. This is accepted because manifests are fetched exclusively from RÚV-controlled origins — the *.cdn.ruv.is suffix and the two exact RÚV Akamai tenants — so the child URIs they reference are authored by RÚV. Full per-URI enforcement inside the media pipeline is tracked for a future release.

The Flatpak has network access for those services, display access for Wayland with fallback X11, PulseAudio access for playback, and GPU acceleration. It has no host filesystem, camera, microphone, device-wide, session-bus, or system-bus permission. It stores no credentials and includes no analytics or tracking.

Native development and verification

Rust 1.93 or newer and the GStreamer development libraries are required:

cargo fmt --check --manifest-path apps/ruv/Cargo.toml
cargo test --all-targets --locked --manifest-path apps/ruv/Cargo.toml
cargo clippy --all-targets --locked --manifest-path apps/ruv/Cargo.toml -- -D warnings
desktop-file-validate apps/ruv/data/org.bifrost.Ruv.desktop
appstreamcli validate --no-net apps/ruv/data/org.bifrost.Ruv.metainfo.xml
cargo run --locked --manifest-path apps/ruv/Cargo.toml \
  --bin bifrost-ruv

The contract tests cover RSS, GraphQL, search, schedules, URL trust including deceptive-suffix hosts, bounded responses, loopback mock-HTTP transport behavior (byte caps, deadlines, redirect policy, download concurrency), player URL policy, and volume bounds. A UI or playback change also requires a Flatpak build and an exercised launch; compilation alone is not sufficient.

Cargo.lock and cargo-sources.json are reviewed source-acquisition inputs, not disposable build products. After intentionally changing dependencies, refresh both from the repository root with a current checkout of flatpak-builder-tools:

cargo generate-lockfile --manifest-path apps/ruv/Cargo.toml
python3 /path/to/flatpak-builder-tools/cargo/flatpak-cargo-generator.py \
  apps/ruv/Cargo.lock -o apps/ruv/cargo-sources.json
cargo test --locked --manifest-path apps/ruv/Cargo.toml

Review the lockfile and generated source URLs, revisions, and checksums together. The Flatpak build uses cargo --offline --locked; it does not resolve or fetch Cargo dependencies in the build sandbox.

Flatpak candidate

Install Flatpak Builder and the Freedesktop 25.08 SDK, Rust SDK extension, and the stable com.system76.Cosmic.BaseApp, then run:

flatpak-builder --user --install-deps-from=flathub --force-clean \
  --default-branch=stable build/ruv apps/ruv/org.bifrost.Ruv.yml

BaseApp pin

The manifest builds against com.system76.Cosmic.BaseApp//stable. Flathub publishes no versioned branch for this BaseApp, so stable is the only available ref; it currently targets org.freedesktop.Platform//25.08, matching this manifest's runtime-version. The commit audited for this release is recorded as a comment next to base-version in org.bifrost.Ruv.yml (b3f1b274d54062… as of 2026-08-07, verified with flatpak remote-info --user flathub com.system76.Cosmic.BaseApp).

Update policy: whenever runtime-version is bumped, or before each release candidate, re-run flatpak remote-info for the BaseApp, confirm its Runtime and Sdk lines still match the manifest runtime, and refresh the audited commit comment. If Flathub ever publishes versioned BaseApp branches, switch base-version to the branch matching the Freedesktop runtime in use.

To create an unsigned bundle for review:

flatpak-builder --user --install-deps-from=flathub --force-clean \
  --default-branch=stable --repo=repo/ruv build/ruv \
  apps/ruv/org.bifrost.Ruv.yml
flatpak build-bundle repo/ruv org.bifrost.Ruv.flatpak \
  org.bifrost.Ruv stable --arch=x86_64
sha256sum org.bifrost.Ruv.flatpak

The application repository never receives the BifrOSt application-release private key and never publishes directly to the trusted catalog. A reviewed candidate is admitted, signed, and published only by a release operator using dispatch-app-release.py from olibuijr/BifrOSt.