BifrOSt-Apps

public

Latest change 9ee01c744bdd89e0d16142cb57cdff4e3d117380 - Refresh documentation after 0.2.2 and the RUV 0.1.1 candidate by Ólafur Búi Ólafsson

# BifrOSt RÚV

`org.bifrost.Ruv` is an Icelandic-first television application built natively
for COSMIC with Rust and libcosmic. It presents RÚV news, video on demand,
search, television schedules, and the RÚV and RÚV 2 live streams in a
remote-control-friendly interface. English is available as a complete fallback.

## Features

- Icelandic-first `Aðalskjár`, Live, Guide, On demand, and Search navigation
with a complete English fallback.
- RÚV RSS news and article reading, GraphQL programme shelves and episode
details, dated RÚV/RÚV 2 schedules, and combined programme/news search.
- Responsive one-to-four-column layouts with uncropped 16:9 WebP artwork and
at most four concurrent image downloads.
- RÚV and RÚV 2 HTTPS HLS playback with play/pause, replay, ±10-second seek,
timeline, volume, mute, fullscreen, and keyboard controls.
- Independent 640×360 RÚV and RÚV 2 live frames, shown side by side on wide
viewports and refreshed every minute without starting audible playback.
- The official square RÚV icon at 32, 64, 128, 256, and 512 pixel sizes.

This is an independent client. RÚV owns its names, programming, editorial
content, imagery, streams, and trademarks; BifrOSt and this application are not
affiliated with or endorsed by RÚV. The application icon uses the official
square RÚV logo from [RÚV’s public brand-assets page](https://www.ruv.is/um-ruv/merki).

## Data and sandbox

The application reads public RÚV RSS, GraphQL, search, image, and HTTPS media
endpoints. Article HTML is converted to plain readable text before display.
Playback uses `iced_video_player` with a GStreamer `playbin3` pipeline compatible
with the current streams-aware HLS demuxer. The live resolver may return
short-lived `*.cdn.ruv.is` hosts; the media policy accepts that RÚV-owned suffix
and the two exact RÚV Akamai tenants, while rejecting unrelated origins.

Origin policy for HLS is enforced on the top-level resolved manifest URL only:
the address handed to the pipeline is validated against the media allowlist,
after which GStreamer resolves child playlists, media segments, and encryption
keys autonomously without re-entering that check. This is accepted because
manifests are fetched exclusively from RÚV-controlled origins — the
`*.cdn.ruv.is` suffix and the two exact RÚV Akamai tenants — so the child URIs
they reference are authored by RÚV. Full per-URI enforcement inside the media
pipeline is tracked for a future release.

The Flatpak has network access for those services, display access for Wayland
with fallback X11, PulseAudio access for playback, and GPU acceleration. It has
no host filesystem, camera, microphone, device-wide, session-bus, or system-bus
permission. It stores no credentials and includes no analytics or tracking.

## Native development and verification

Rust 1.93 or newer and the GStreamer development libraries are required:

```bash
cargo fmt --check --manifest-path apps/ruv/Cargo.toml
cargo test --all-targets --locked --manifest-path apps/ruv/Cargo.toml
cargo clippy --all-targets --locked --manifest-path apps/ruv/Cargo.toml -- -D warnings
desktop-file-validate apps/ruv/data/org.bifrost.Ruv.desktop
appstreamcli validate --no-net apps/ruv/data/org.bifrost.Ruv.metainfo.xml
cargo run --locked --manifest-path apps/ruv/Cargo.toml \
--bin bifrost-ruv
```

The contract tests cover RSS, GraphQL, search, schedules, URL trust including
deceptive-suffix hosts, bounded responses, loopback mock-HTTP transport
behavior (byte caps, deadlines, redirect policy, download concurrency),
player URL policy, and volume bounds. A UI or playback change also
requires a Flatpak build and an exercised launch; compilation alone is not
sufficient.

`Cargo.lock` and `cargo-sources.json` are reviewed source-acquisition inputs,
not disposable build products. After intentionally changing dependencies,
refresh both from the repository root with a current checkout of
[`flatpak-builder-tools`](https://github.com/flatpak/flatpak-builder-tools):

```bash
cargo generate-lockfile --manifest-path apps/ruv/Cargo.toml
python3 /path/to/flatpak-builder-tools/cargo/flatpak-cargo-generator.py \
apps/ruv/Cargo.lock -o apps/ruv/cargo-sources.json
cargo test --locked --manifest-path apps/ruv/Cargo.toml
```

Review the lockfile and generated source URLs, revisions, and checksums together.
The Flatpak build uses `cargo --offline --locked`; it does not resolve or fetch
Cargo dependencies in the build sandbox.

## Flatpak candidate

Install Flatpak Builder and the Freedesktop 25.08 SDK, Rust SDK extension, and
the stable `com.system76.Cosmic.BaseApp`, then run:

```bash
flatpak-builder --user --install-deps-from=flathub --force-clean \
--default-branch=stable build/ruv apps/ruv/org.bifrost.Ruv.yml
```

### BaseApp pin

The manifest builds against `com.system76.Cosmic.BaseApp//stable`. Flathub
publishes no versioned branch for this BaseApp, so `stable` is the only
available ref; it currently targets `org.freedesktop.Platform//25.08`, matching
this manifest's `runtime-version`. The commit audited for this release is
recorded as a comment next to `base-version` in `org.bifrost.Ruv.yml`
(`b3f1b274d54062…` as of 2026-08-07, verified with
`flatpak remote-info --user flathub com.system76.Cosmic.BaseApp`).

Update policy: whenever `runtime-version` is bumped, or before each release
candidate, re-run `flatpak remote-info` for the BaseApp, confirm its Runtime
and Sdk lines still match the manifest runtime, and refresh the audited commit
comment. If Flathub ever publishes versioned BaseApp branches, switch
`base-version` to the branch matching the Freedesktop runtime in use.

To create an unsigned bundle for review:

```bash
flatpak-builder --user --install-deps-from=flathub --force-clean \
--default-branch=stable --repo=repo/ruv build/ruv \
apps/ruv/org.bifrost.Ruv.yml
flatpak build-bundle repo/ruv org.bifrost.Ruv.flatpak \
org.bifrost.Ruv stable --arch=x86_64
sha256sum org.bifrost.Ruv.flatpak
```

The current candidate version is 0.1.1; `Cargo.toml` and the AppStream release
entry agree. One task remains open before publication: the metainfo references
two screenshots that have not yet been captured from a running build. Follow
the instructions in [`data/screenshots/README.txt`](data/screenshots/README.txt)
to produce them.

The application repository never receives the BifrOSt application-release
private key and never publishes directly to the trusted catalog. A reviewed
candidate is admitted, signed, and published only by a release operator using
`dispatch-app-release.py` from `olibuijr/BifrOSt`.