Skip to content
PAM

Distribution

PAM Desktop 1.1.2 defines the stable Linux x86-64 distribution contract. Automatic application updates use signed Ed25519 feeds; GitHub host releases ship reproducible archives with adjacent SHA-256 files.

Application manifest

Section titled “Application manifest”
use Pam\Desktop\ApplicationCategory;
use Pam\Desktop\Manifest;


$manifest = Manifest::create(
    'com.example.my-app',
    'My desktop app',
    '1.1.2',
)
    ->description('A PHP-first desktop application.')
    ->publisher('Example')
    ->category(ApplicationCategory::Development)
    ->icon('resources/icon.svg');

The identifier uses reverse-DNS form. Icons are validated PNG or SVG assets. Category is an integer-backed enum mapped to platform package metadata.

Build formats

Section titled “Build formats”

The default creates a directory and portable archive:

Terminal window
pam desktop build .

Select formats and output:

Terminal window
pam desktop build . \
  --output dist \
  --format directory


pam desktop build . \
  --output dist \
  --format portable


pam desktop build . \
  --output dist \
  --format deb


pam desktop build . \
  --output dist \
  --format all

Debian packaging requires dpkg-deb.

Existing artifacts are not replaced unless the caller explicitly passes --force.

Bundle contents

Section titled “Bundle contents”

A self-contained Linux bundle includes:

  • the exact PAM worker binary;
  • the exact pam-desktop Servo host;
  • required PHP and native runtime libraries;
  • an isolated minimal php.ini;
  • the application and materialized Composer dependencies;
  • frontend assets;
  • application icon and Freedesktop entry;
  • a launcher with private runtime paths;
  • configured Rust plugin executables;
  • portable install.sh and uninstall.sh when applicable; and
  • manifest.json.

The launcher sets PAM_BINARY, PHPRC, PHP_INI_SCAN_DIR, and LD_LIBRARY_PATH before production run mode.

Build validation

Section titled “Build validation”

The packager boots the same PHP application and validates the same protocol bootstrap used at runtime.

It stages into a random directory under the output, rejects unsafe project symlinks, materializes Composer package symlinks only when safe, omits configured exclusions and secrets, and copies trusted runtime binaries.

ldd runs only against those trusted binaries. Non-glibc runtime libraries are copied beside the application.

Integrity manifest

Section titled “Integrity manifest”

manifest.json records:

  • protocol version;
  • public PHP API and Rust plugin protocol versions;
  • application identity and version;
  • runtime version;
  • operating-system and architecture target;
  • each included file;
  • byte size; and
  • SHA-256 digest.

Entries are sorted. Publication is an atomic rename from a completed staging directory.

Reproducibility

Section titled “Reproducibility”

Archive metadata uses SOURCE_DATE_EPOCH, or zero when unset:

Terminal window
SOURCE_DATE_EPOCH=1784937600 \
  pam desktop build . --format portable

Reproducible metadata reduces avoidable archive differences. Native toolchain and input differences can still change bytes.

Portable install

Section titled “Portable install”

The portable archive’s installer uses per-user XDG application and data locations and refreshes the desktop database when the host provides the command.

The uninstaller removes the corresponding per-user application files. Review application-owned user data separately; package removal should not silently destroy user documents.

Current platform matrix

Section titled “Current platform matrix”
Platform Status
Linux directory bundle Implemented
Portable Linux .tar.gz Implemented
Debian .deb Implemented when dpkg-deb is available
Signed automatic updates Implemented for Linux x86-64
Windows package Experimental, not published or supported
macOS package Deferred until Apple hardware is available
GitHub host archive provenance Implemented with GitHub artifact attestation

See signed updates and stability and support.