feat(desktop): build rpm bundle

Add the rpm target with Fedora deps and share the helper setcap
postinst between deb and rpm; collect *.rpm in release and nightly.

Author: loss-and-quick

.github/workflows/nightly.yml

@@ -226,7 +226,7 @@ jobs:
           dir="target/${{ matrix.target }}/release/bundle"
           mkdir -p dist
           find "$dir" -type f \
-            \( -name '*.deb' -o -name '*.AppImage' -o -name '*-setup.exe' -o -name '*.msi' \) \
+            \( -name '*.deb' -o -name '*.rpm' -o -name '*.AppImage' -o -name '*-setup.exe' -o -name '*.msi' \) \
             -exec cp {} dist/ \;
           ls -la dist
 

.github/workflows/release.yml

@@ -323,7 +323,7 @@ jobs:
           # here), so the name lives in one place — same as nightly.yml.
           files: build/*.zip
 
-  # ── Desktop installers (Linux deb/AppImage, Windows NSIS/MSI + portable zip) →
+  # ── Desktop installers (Linux deb/rpm/AppImage, Windows NSIS/MSI + portable zip) →
   #    uploaded to the same release. Cores are fetched per-target into
   #    src-tauri/binaries/ and bundled via the externalBin overlay. AppImage GPG
   #    signing is opt-in (active only when the secret is set). macOS isn't shipped
@@ -427,7 +427,7 @@ jobs:
           dir="target/${{ matrix.target }}/release/bundle"
           mkdir -p dist
           find "$dir" -type f \
-            \( -name '*.deb' -o -name '*.AppImage' -o -name '*-setup.exe' -o -name '*.msi' -o -name '*.sig' \) \
+            \( -name '*.deb' -o -name '*.rpm' -o -name '*.AppImage' -o -name '*-setup.exe' -o -name '*.msi' -o -name '*.sig' \) \
             -exec cp {} dist/ \;
           ls -la dist
 

src-tauri/deb/postinst.sh src-tauri/linux/postinst.shsrc-tauri/deb/postinst.sh renamed to src-tauri/linux/postinst.sh

@@ -1,8 +1,8 @@
 #!/bin/sh
 # Grant the data-path helper its Linux file capabilities at install time, so the GUI
-# can launch it directly — no pkexec prompt — on a deb install. The cap set mirrors
-# the helper's in-code keep-set (see src/desktop/capabilities.rs) and the NixOS
-# `security.wrappers` string. Non-deb installs do the same once at first run via a
+# can launch it directly — no pkexec prompt — on a packaged install (deb/rpm). The cap
+# set mirrors the helper's in-code keep-set (see src/desktop/capabilities.rs) and the
+# NixOS `security.wrappers` string. Other installs do the same once at first run via a
 # `pkexec setcap` (see privhelper::spawn); NixOS uses the wrapper.
 #
 # Best-effort: a setcap failure (no libcap, a filesystem without xattrs) leaves the
@@ -13,7 +13,7 @@ caps="cap_net_admin,cap_net_raw,cap_chown,cap_dac_override+ep"
 
 if command -v setcap >/dev/null 2>&1; then
     # The helper ships as a tauri sidecar beside the GUI; cover both layouts tauri
-    # may use for the deb (next to the binary, or under the product libdir).
+    # may use (next to the binary, or under the product libdir).
     for helper in /usr/bin/kasumi-helper "/usr/lib/Kasumi Proxy/kasumi-helper"; do
         if [ -f "$helper" ]; then
             setcap "$caps" "$helper" || true

src-tauri/tauri.conf.json

@@ -25,7 +25,7 @@
   "bundle": {
     "active": true,
     "createUpdaterArtifacts": true,
-    "targets": ["deb", "appimage", "nsis", "msi"],
+    "targets": ["deb", "rpm", "appimage", "nsis", "msi"],
     "category": "Utility",
     "shortDescription": "System-wide transparent proxy (Xray-core / sing-box).",
     "longDescription": "Kasumi Proxy routes all traffic through Xray-core or sing-box with a native TUN and policy routing, managed from a clean React UI.",
@@ -42,7 +42,11 @@
     "linux": {
       "deb": {
         "depends": ["libwebkit2gtk-4.1-0", "libgtk-3-0", "libayatana-appindicator3-1"],
-        "postInstallScript": "deb/postinst.sh"
+        "postInstallScript": "linux/postinst.sh"
+      },
+      "rpm": {
+        "depends": ["webkit2gtk4.1", "gtk3", "libayatana-appindicator-gtk3"],
+        "postInstallScript": "linux/postinst.sh"
       }
     },
     "windows": {