fix snapcraft libusb

Author: fcjr

.github/workflows/release.yml

@@ -175,9 +175,6 @@ jobs:
               > "completions/restorekit.$shell"
           done
 
-      - name: Install snapcraft
-        run: sudo snap install snapcraft --classic
-
       - uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
@@ -187,4 +184,55 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # One token for both the Homebrew tap and the Scoop bucket.
           TAP_GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN }}
+
+  # Pack the CLI binary into a snap and publish it to the Snap Store as
+  # `restorekit-cli` (the plain `restorekit` name is the desktop app, published
+  # from release-app.yml). GoReleaser can't do this: the binary links libusb
+  # dynamically, core24 doesn't ship libusb-1.0.so.0, and its `snapcrafts`
+  # block has no `stage-packages` escape hatch.
+  #
+  # One runner per arch — destructive mode builds on the host directly, so
+  # stage-packages can only pull the host's debs, and ubuntu-24.04 matches the
+  # snap's core24 base. Pack runs under sudo (snapcraft shells out to `snap`,
+  # which snapd only allows as root) and swallows snap's stderr, so dump its
+  # log on failure to see the real error.
+  snap:
+    # After `release`, not just `build`, so a failed GitHub release can't leave
+    # a published snap behind (the ordering GoReleaser gave us before).
+    needs: [release]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            goarch: amd64
+          - os: ubuntu-24.04-arm
+            goarch: arm64
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download the prebuilt binary
+        uses: actions/download-artifact@v4
+        with:
+          name: restorekit_linux_${{ matrix.goarch }}
+          path: snapbuild/bin
+
+      - name: Build & publish the snap
+        env:
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME#v}"
+          sudo snap install snapcraft --classic
+          # The executable bit doesn't survive the artifact round-trip.
+          chmod +x snapbuild/bin/restorekit
+          sed "s/VERSION_PLACEHOLDER/${version}/" crates/restorekit-cli/snap/snapcraft.yaml \
+            > snapbuild/snapcraft.yaml
+          cd snapbuild
+          sudo snapcraft pack --destructive-mode || {
+            sudo cat /root/.local/state/snapcraft/log/*.log
+            exit 1
+          }
+          snapcraft upload --release=stable \
+            "restorekit-cli_${version}_${{ matrix.goarch }}.snap"

.goreleaser.yaml

@@ -78,30 +78,10 @@ homebrew_casks:
       needs root for that step (sudo restorekit dfu). Restores run on macOS
       and Linux.
 
-snapcrafts:
-  # Same naming rationale as the cask: the plain `restorekit` snap name is
-  # reserved for the desktop app. The app key below is what users type, so
-  # the command is `restorekit-cli` (the inner binary is still `restorekit`).
-  - name: restorekit-cli
-    ids: [restorekit]
-    title: restorekit
-    summary: DFU-restore Apple Silicon Macs from the command line
-    description: |
-      restorekit lets you fully wipe or restore a T2 or M series mac without
-      using any apple tools. Plug the target mac into your host's DFU port,
-      put it in DFU mode (automatic DFU only works from a macOS host), then:
-
-          sudo restorekit-cli erase
-    license: Apache-2.0
-    grade: stable
-    confinement: strict
-    base: core24
-    publish: true
-    channel_templates: [stable]
-    apps:
-      restorekit-cli:
-        command: restorekit
-        plugs: [home, network, raw-usb, removable-media]
+# No `snapcrafts:` block — the snap is packed by hand from
+# crates/restorekit-cli/snap/snapcraft.yaml in release.yml. The binary links
+# libusb dynamically and core24 doesn't ship it, so the snap needs
+# `stage-packages`, which GoReleaser's snapcrafts block can't express.
 
 scoops:
   # Same naming rationale as the cask: the plain `restorekit` name is reserved

apps/desktop/snap/snapcraft.yaml

@@ -37,9 +37,13 @@ parts:
     plugin: dump
     source: restorekit.deb
     source-type: deb
-    # GTK3 comes from the gnome extension; webkit2gtk does not.
+    # GTK3 comes from the gnome extension; webkit2gtk does not. Neither does
+    # libusb — restorekit-desktop links it dynamically, and it's in neither
+    # core22 nor gnome-42-2204, so the app dies at exec with
+    # "libusb-1.0.so.0: cannot open shared object file".
     stage-packages:
       - libwebkit2gtk-4.1-0
+      - libusb-1.0-0
     override-build: |
       craftctl default
       sed -i 's|^Icon=.*|Icon=/usr/share/icons/hicolor/128x128/apps/restorekit-desktop.png|' \

crates/restorekit-cli/snap/snapcraft.yaml

@@ -0,0 +1,43 @@
+# Template for the CLI's snap, packed from the prebuilt binary in release.yml
+# (VERSION_PLACEHOLDER is filled in there, same pattern as the desktop app's
+# snap). The plain `restorekit` snap name is the desktop app; the CLI ships
+# here as `restorekit-cli`. The app key below is what users type, so the
+# command is `restorekit-cli` (the inner binary is still `restorekit`).
+#
+# Hand-written rather than generated by GoReleaser's `snapcrafts` block: the
+# binary links libusb dynamically and core24 doesn't ship libusb-1.0.so.0, and
+# GoReleaser has no way to add stage-packages to the snap it generates.
+#
+# base core24 must match the runner the binary is built on (ubuntu-24.04) —
+# bump both together. `platforms` is omitted on purpose: it defaults to the
+# host architecture, and each arch is packed on its own runner.
+name: restorekit-cli
+title: restorekit
+base: core24
+version: "VERSION_PLACEHOLDER"
+summary: DFU-restore Apple Silicon Macs from the command line
+description: |
+  restorekit lets you fully wipe or restore a T2 or M series mac without
+  using any apple tools. Plug the target mac into your host's DFU port,
+  put it in DFU mode (automatic DFU only works from a macOS host), then:
+
+      sudo restorekit-cli erase
+
+license: Apache-2.0
+grade: stable
+confinement: strict
+
+apps:
+  restorekit-cli:
+    command: restorekit
+    plugs: [home, network, raw-usb, removable-media]
+
+parts:
+  restorekit:
+    plugin: dump
+    # release.yml stages the downloaded binary as bin/restorekit next to this
+    # file; dumping the directory keeps snapcraft.yaml itself out of the snap.
+    source: bin
+    # The one library the "self-contained" binary still links dynamically.
+    stage-packages:
+      - libusb-1.0-0