dtourolle
6897b290ed
The repo had no SECURITY.md, CONTRIBUTING.md, code of conduct, or issue and PR templates. For a client that handles Jellyfin credentials and ships signed binaries, the missing one that actually matters is SECURITY.md: there was no stated way to report a vulnerability privately, so the only available channel was the public tracker. CONTRIBUTING.md documents the gates as they now stand, including the three ratchets and which direction each is allowed to move, and the two rules that surprise people: bug fixes start with a failing test, and Jellyfin's taxonomy stays in Rust. The bug template asks the three playback questions -- streaming or downloaded, transcoding or direct, music or video -- because those answers decide which of several very different code paths a report is about, and reconstructing them over several round trips is most of the cost of a playback bug report. docs/build/ci-operations.md is the missing operations manual: how to change the builder image and in what order (image pushed before the workflow that names it, or CI breaks), why tags are dated rather than :latest or per-SHA, what each secret is for, and what losing the updater private key would mean -- installed desktop clients only accept payloads signed by the key matching the public key they shipped with, so losing it means everyone reinstalls by hand. Disk exhaustion on the runner is documented as a manual check rather than a scheduled job. A daily job would occupy the only slot on a single-slot runner and pull the whole builder image to run `df` -- and `df` inside a container does not reliably describe the host's disk, so it would spend real build capacity reporting a number that might be wrong. What the doc records instead is the part that is actually hard to rediscover: the symptoms (cargo dying mid-link, docker refusing to pull, actions/cache quietly not saving) and that `docker volume prune` needs `-a` to touch named volumes, which is how it filled up unnoticed. Two things in these docs are stated plainly because they are true and were not written down anywhere: without branch protection every gate in the pipeline is advisory, and the Gitea instance -- canonical remote, signing secrets, registry, runner -- is not backed up by anything in this repository.
84 lines
2.7 KiB
Markdown
84 lines
2.7 KiB
Markdown
<h1 align="center">
|
|
<img src="docs/assets/logo.png" alt="JellyTau logo" width="120" /><br />
|
|
JellyTau
|
|
</h1>
|
|
|
|
A cross-platform Jellyfin client built with Tauri, SvelteKit, and TypeScript.
|
|
|
|
Business logic lives in a Rust backend; a UI-rich Svelte frontend handles
|
|
presentation and talks to it over Tauri's IPC. Targets Linux (libmpv) and
|
|
Android (ExoPlayer).
|
|
|
|
## Getting Started
|
|
|
|
This project uses [bun](https://bun.sh) as its package manager.
|
|
|
|
```bash
|
|
# Activate the Rust environment (fish shell)
|
|
source "$HOME/.cargo/env.fish"
|
|
|
|
# Install dependencies
|
|
bun install
|
|
|
|
# Run in development
|
|
bun run tauri dev
|
|
|
|
# Type-check the frontend
|
|
bun run check
|
|
|
|
# Build for Linux
|
|
bun run tauri build
|
|
|
|
# Build for Android
|
|
bun run tauri android build
|
|
```
|
|
|
|
For the full set of build, test, and Android helper scripts, see
|
|
[scripts/README.md](scripts/README.md).
|
|
|
|
## Documentation
|
|
|
|
| Topic | Location |
|
|
|-------|----------|
|
|
| Architecture overview & subsystem docs | [docs/architecture/](docs/architecture/) |
|
|
| Requirements, traceability & technical debt | [docs/requirements.md](docs/requirements.md) |
|
|
| Build & release process | [docs/build/build-release.md](docs/build/build-release.md) |
|
|
| Docker builds | [docs/build/docker.md](docs/build/docker.md) |
|
|
| Traceability tooling & CI | [docs/traceability.md](docs/traceability.md), [docs/traceability-ci.md](docs/traceability-ci.md) |
|
|
| Release checklist | [docs/release-checklist.md](docs/release-checklist.md) |
|
|
| UX flows | [docs/ux-flows.md](docs/ux-flows.md) |
|
|
| CI operations (builder image, secrets, runner) | [docs/build/ci-operations.md](docs/build/ci-operations.md) |
|
|
|
|
## Contributing
|
|
|
|
[CONTRIBUTING.md](CONTRIBUTING.md) covers the setup, the gates a change has to
|
|
pass, and the two rules that catch people out (bug fixes start with a failing
|
|
test; Jellyfin's taxonomy stays in Rust). Please also read the
|
|
[Code of Conduct](CODE_OF_CONDUCT.md).
|
|
|
|
Found a security problem? Do not open an issue — see [SECURITY.md](SECURITY.md).
|
|
|
|
## Verifying a download
|
|
|
|
Every release publishes `SHA256SUMS` covering all of its artifacts, plus an SBOM
|
|
of what went into the build:
|
|
|
|
```bash
|
|
sha256sum -c SHA256SUMS
|
|
```
|
|
|
|
Desktop builds update themselves from Settings → Updates, verifying each payload
|
|
against JellyTau's signing key before installing. Android installs are handled by
|
|
the system installer, so the app links to the releases page instead.
|
|
|
|
## Recommended IDE Setup
|
|
|
|
[VS Code](https://code.visualstudio.com/) +
|
|
[Svelte](https://marketplace.visualstudio.com/items?itemName=svelte.svelte-vscode) +
|
|
[Tauri](https://marketplace.visualstudio.com/items?itemName=tauri-apps.tauri-vscode) +
|
|
[rust-analyzer](https://marketplace.visualstudio.com/items?itemName=rust-lang.rust-analyzer).
|
|
|
|
## License
|
|
|
|
MIT
|