From b550a979e85e0541c5df6dce26e2cdcea493737b Mon Sep 17 00:00:00 2001
From: blessdyb <blessdyb@gmail.com>
Date: Thu, 1 Oct 2026 08:52:53 -0700
Subject: [PATCH 1/2] An icon the desktop can actually draw
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported from the desktop: the application icon does not render. The file was installed where it belongs,
the desktop entry validated, and GTK's icon theme resolved the name to the file — `has_icon` said true.
It had never drawn it. `has_icon` consults an index; it does not load anything.

gdk-pixbuf recognises a file by sniffing its first bytes, and its SVG loader looks for `<svg` near the
start. This icon opened with a nine-line comment explaining the drawing, which put `<svg` 501 bytes in:

    a working system icon   <svg at byte  55   loads
    ours                    <svg at byte 501   "couldn't recognize the image file format"
    ours, comment removed   <svg at byte  40   loads

The file was valid SVG the whole time, and nothing warns about this. The comment that broke it ended with
the words "nothing in the packaging depends on what is in here".

So the comment moved inside the element, where it says the same things and also says this. And CI now
draws the icon on every push, through gdk-pixbuf, because that is the only thing that sees the bug:
`rsvg-convert` parses the file directly and accepts the broken one, and `gdk-pixbuf-thumbnailer` warns
about it and still exits 0. The check looks at whether a PNG came out. Against the broken file none does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml                      | 26 +++++++++++++++++
 Cargo.lock                                    | 28 +++++++++----------
 Cargo.toml                                    |  2 +-
 .../desktop/com.xinbetween.Flowlight.svg      | 22 +++++++++------
 4 files changed, 55 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8543ccd..079325d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,6 +87,32 @@ jobs:
           fi
           echo "every row goes through the helper"
 
+      # The desktop draws this file through gdk-pixbuf, which recognises a format by sniffing the first
+      # bytes of it: the SVG loader looks for `<svg` near the start. A comment written above the element
+      # pushed `<svg` 501 bytes in, and every consumer answered "couldn't recognize the image file format"
+      # while the file stayed perfectly valid SVG — so the dock, the app grid and the window all drew
+      # nothing, and nothing anywhere said why.
+      #
+      # It has to be this tool. `rsvg-convert` parses the file directly, accepts the broken one and exits 0,
+      # so a check built on it proves nothing. And the thumbnailer warns and *also* exits 0, so the check
+      # has to look at what came out rather than at the exit status. Both were tried against the broken
+      # file before this was written.
+      - name: The icon is an icon as far as the desktop is concerned
+        run: |
+          set -euo pipefail
+          sudo apt-get install -y -qq libgdk-pixbuf2.0-bin librsvg2-common
+          icon=packaging/desktop/com.xinbetween.Flowlight.svg
+          at=$(grep -abo '<svg' "$icon" | head -1 | cut -d: -f1)
+          echo "<svg starts at byte $at"
+          rm -f /tmp/icon.png
+          gdk-pixbuf-thumbnailer -s 64 "$icon" /tmp/icon.png || true
+          if [ ! -s /tmp/icon.png ]; then
+            echo "gdk-pixbuf cannot draw this file, so no desktop will either."
+            echo "<svg is $at bytes in; the loader sniffs the start of the file. Keep comments inside the element."
+            exit 1
+          fi
+          echo "the icon draws: $(stat -c %s /tmp/icon.png) bytes of PNG"
+
       - name: A row shows the text it was given
         run: |
           set -euo pipefail
diff --git a/Cargo.lock b/Cargo.lock
index 596e6a3..800bd55 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -540,7 +540,7 @@ checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
 [[package]]
 name = "flowlight-agents"
-version = "0.5.13"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "serde",
@@ -550,11 +550,11 @@ dependencies = [
 
 [[package]]
 name = "flowlight-alerts"
-version = "0.5.13"
+version = "0.5.15"
 
 [[package]]
 name = "flowlight-ask"
-version = "0.5.13"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "flowlight-store",
@@ -565,14 +565,14 @@ dependencies = [
 
 [[package]]
 name = "flowlight-common"
-version = "0.5.13"
+version = "0.5.15"
 dependencies = [
  "aya",
 ]
 
 [[package]]
 name = "flowlight-daemon"
-version = "0.5.13"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "aya",
@@ -598,14 +598,14 @@ dependencies = [
 
 [[package]]
 name = "flowlight-devices"
-version = "0.5.13"
+version = "0.5.15"
 dependencies = [
  "anyhow",
 ]
 
 [[package]]
 name = "flowlight-ebpf"
-version = "0.5.13"
+version = "0.5.15"
 dependencies = [
  "aya-ebpf",
  "flowlight-common",
@@ -613,7 +613,7 @@ dependencies = [
 
 [[package]]
 name = "flowlight-gui"
-version = "0.5.13"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "async-channel",
@@ -625,14 +625,14 @@ dependencies = [
 
 [[package]]
 name = "flowlight-owners"
-version = "0.5.13"
+version = "0.5.15"
 dependencies = [
  "anyhow",
 ]
 
 [[package]]
 name = "flowlight-platform"
-version = "0.5.13"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "libc",
@@ -640,7 +640,7 @@ dependencies = [
 
 [[package]]
 name = "flowlight-proxy"
-version = "0.5.13"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "flowlight-agents",
@@ -656,7 +656,7 @@ dependencies = [
 
 [[package]]
 name = "flowlight-rules"
-version = "0.5.13"
+version = "0.5.15"
 dependencies = [
  "serde",
  "serde_json",
@@ -664,7 +664,7 @@ dependencies = [
 
 [[package]]
 name = "flowlight-store"
-version = "0.5.13"
+version = "0.5.15"
 dependencies = [
  "anyhow",
  "flowlight-alerts",
@@ -677,7 +677,7 @@ dependencies = [
 
 [[package]]
 name = "flowlight-text"
-version = "0.5.13"
+version = "0.5.15"
 
 [[package]]
 name = "foldhash"
diff --git a/Cargo.toml b/Cargo.toml
index 724aab0..4b3e59e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,7 +36,7 @@ default-members = [
 ]
 
 [workspace.package]
-version = "0.5.13"
+version = "0.5.15"
 edition = "2024"
 license = "GPL-3.0-only"
 repository = "https://github.com/xinbetween/flowlight-linux"
diff --git a/packaging/desktop/com.xinbetween.Flowlight.svg b/packaging/desktop/com.xinbetween.Flowlight.svg
index 1370ace..15dce97 100644
--- a/packaging/desktop/com.xinbetween.Flowlight.svg
+++ b/packaging/desktop/com.xinbetween.Flowlight.svg
@@ -1,14 +1,20 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!--
-  A plain mark rather than a logo: three flows crossing a lens, and one of them stopped.
-
-  That is the program — traffic read as it passes, and one connection refused — and it is drawn with four
-  shapes so that it still reads at 16 pixels, where anything with detail in it becomes a smudge. Replace it
-  with something better whenever there is something better; nothing in the packaging depends on what is in
-  here, only on the name of the file.
--->
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128"
      role="img" aria-label="Flowlight">
+  <!--
+    The comment goes inside the element, and has to.
+
+    gdk-pixbuf recognises a file by sniffing its first bytes, and the SVG loader looks for `<svg` near the
+    start. This file used to open with a nine-line comment, which put `<svg` 501 bytes in, past where
+    anything looks — so every consumer of it answered "couldn't recognize the image file format" and the
+    desktop drew no icon at all. The file was valid SVG the whole time. Nothing warns about this.
+
+    A plain mark rather than a logo: three flows crossing a lens, and one of them stopped. That is the
+    program — traffic read as it passes, and one connection refused — drawn with four shapes so that it
+    still reads at 16 pixels, where anything with detail in it becomes a smudge. Replace it with something
+    better whenever there is something better; nothing in the packaging depends on what is in here, only on
+    the name of the file and on `<svg` staying where it is.
+  -->
   <rect width="128" height="128" rx="28" fill="#16181d"/>
 
   <!-- Two flows that pass. The gap in the middle is the lens, and the lines stop at its edge rather than

From 70a9e947afd611f039f8cfb22839fd939fb02607 Mon Sep 17 00:00:00 2001
From: blessdyb <blessdyb@gmail.com>
Date: Thu, 1 Oct 2026 08:53:13 -0700
Subject: [PATCH 2/2] Say in the README where <svg has to be

The next person to improve this icon will put a comment at the top of it, because that is where comments
go. Said beside the other things about the window that are not obvious from the code.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 README.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/README.md b/README.md
index 14251f5..2813e6c 100644
--- a/README.md
+++ b/README.md
@@ -108,6 +108,13 @@ including an installation from it with a throwaway key, and goes live once a sig
 [`packaging/apt/README.md`](packaging/apt/README.md) says why that key is not something this code can create for
 you. Until it is, the commands above have nothing to answer them.
 
+**The application icon.** It is one SVG, at
+`/usr/share/icons/hicolor/scalable/apps/com.xinbetween.Flowlight.svg`, and the desktop draws it through
+gdk-pixbuf — which recognises the format by sniffing the first bytes of the file. Keep `<svg` near the start.
+Until v0.5.15 a comment sat above it, `<svg` began 501 bytes in, and every desktop answered "couldn't
+recognize the image file format" and drew no icon, with the file remaining valid SVG throughout. CI now draws
+the icon through the same loader on every push.
+
 **What the window shows is text, not markup.** Every row carries something that came off the network — a
 host, a path, a process name — and libadwaita reads a row's title as Pango markup unless it is told otherwise
 first. Until v0.5.13 a request with two query parameters rendered as an empty row, and a path containing