packaging: keep the signing certificate in a private folder and bound the Flatpak tarball

* MIDI: index controller dedup by channel and kind

Remove Duplicate Notes rescanned every controller already kept at the
same tick for each incoming one. A session whose sequence holds one tick
with many distinct channel/controller pairs made that quadratic and
blocked editing. Track where each channel+kind sits at the current tick
in a map instead; the last event per key still wins.

* MIDI: tag dedup index entries with their tick instead of clearing per tick

Clearing the map on every tick change cost O(capacity) per tick after a
dense tick. Store the tick with each entry and treat entries from an
earlier tick as absent. Add an oracle test comparing against the
previous per-tick rescan on mixed-tick input.

crates/clap-host/src/lib.rs

@@ -222,10 +222,33 @@ mod tests {
         assert!(plugin_info("reverb").is_none());
     }
 
+    /// A new directory that this test alone created, readable only by its user on Unix. Creation
+    /// fails if the path already exists: the test then loads native libraries from it, so it must
+    /// never reuse a directory someone else could have put a library in. It lives next to the test
+    /// binary (in the build directory), not under the temp dir: `TMPDIR`/`TEMP` can name a shared
+    /// directory without a sticky bit or with inheritable write access, where another user could
+    /// rename or populate it. Anyone who can write to the build directory can already replace the
+    /// test binary itself, so this parent adds no new trust.
+    fn fresh_private_dir(prefix: &str) -> std::path::PathBuf {
+        let exe = std::env::current_exe().expect("test binary path");
+        let parent = exe.parent().expect("test binary has a parent directory");
+        let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |t| t.as_nanos());
+        let d = parent.join(format!("{prefix}-{}-{nanos}", std::process::id()));
+        #[cfg(unix)]
+        let builder = {
+            let mut b = std::fs::DirBuilder::new();
+            std::os::unix::fs::DirBuilderExt::mode(&mut b, 0o700);
+            b
+        };
+        #[cfg(not(unix))]
+        let builder = std::fs::DirBuilder::new();
+        builder.create(&d).unwrap_or_else(|e| panic!("cannot create a fresh test directory {}: {e}", d.display()));
+        d
+    }
+
     #[test]
     fn garbage_files_are_errors_not_crashes() {
-        let d = std::env::temp_dir().join(format!("soundcraft-clap-garbage-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&d);
+        let d = fresh_private_dir("soundcraft-clap-garbage");
         std::fs::create_dir_all(d.join("Bundle.clap/Contents/MacOS")).unwrap();
         std::fs::write(d.join("garbage.clap"), b"\x7fELF this is not a plugin \x00\x01\x02").unwrap();
         std::fs::write(d.join("empty.clap"), b"").unwrap();

crates/midi/src/sequence.rs

@@ -1,4 +1,6 @@
 use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::collections::hash_map::Entry;
 
 /// A MIDI note. Times are in model ticks ([`crate::PPQ`] per quarter note).
 #[derive(Debug, Clone, Copy, PartialEq, Serialize, Deserialize)]
@@ -108,14 +110,28 @@ impl Sequence {
 
         self.ctrls.sort_by_key(|c| c.tick);
         let mut kept: Vec<CtrlEvent> = Vec::with_capacity(self.ctrls.len());
+        // The latest tick and `kept` index of each channel+kind, so a same-tick repeat is found
+        // without rescanning the tick's events (a tick can hold many thousands of distinct keys).
+        // An entry from an earlier tick counts as absent; keeping the tick instead of clearing the
+        // map per tick keeps the work per event constant after a dense tick.
+        let mut last_at: HashMap<(u8, (u8, u8)), (i64, usize)> = HashMap::new();
         for c in self.ctrls.drain(..) {
             // Within a tick, replace an earlier event of the same channel+kind.
-            // Only events at the same tick (the tail of `kept`) can match.
-            let slot =
-                kept.iter_mut().rev().take_while(|k| k.tick == c.tick).find(|k| k.channel == c.channel && kind_key(k.kind) == kind_key(c.kind));
-            match slot {
-                Some(slot) => *slot = c,
-                None => kept.push(c),
+            match last_at.entry((c.channel, kind_key(c.kind))) {
+                Entry::Occupied(mut e) => {
+                    let (tick, idx) = *e.get();
+                    match kept.get_mut(idx) {
+                        Some(slot) if tick == c.tick => *slot = c,
+                        _ => {
+                            e.insert((c.tick, kept.len()));
+                            kept.push(c);
+                        }
+                    }
+                }
+                Entry::Vacant(e) => {
+                    e.insert((c.tick, kept.len()));
+                    kept.push(c);
+                }
             }
         }
         self.ctrls = kept;

crates/midi/tests/it/ops.rs

@@ -222,3 +222,72 @@ fn sequence_serde_round_trip() {
     let json = serde_json::to_string(&seq).unwrap();
     assert_eq!(serde_json::from_str::<Sequence>(&json).unwrap(), seq);
 }
+
+#[test]
+fn remove_duplicates_handles_a_large_same_tick_controller_group() {
+    // Every channel x controller number at one tick, twice: the second copy of each wins. A
+    // rescan of the tick's kept events per incoming event would make this quadratic.
+    let keys: Vec<(u8, u8)> = (0..=255u8).flat_map(|ch| (0..=255u8).map(move |cc| (ch, cc))).collect();
+    let ctrls = [0, 1]
+        .iter()
+        .flat_map(|&pass| keys.iter().map(move |&(channel, cc)| CtrlEvent { tick: 7, channel, kind: CtrlKind::Cc(cc), value: pass }))
+        .collect();
+    let mut seq = Sequence { notes: Vec::new(), ctrls };
+    let start = std::time::Instant::now();
+    assert_eq!(seq.remove_duplicates(), keys.len());
+    assert!(start.elapsed() < std::time::Duration::from_secs(10), "{:?}", start.elapsed());
+    assert_eq!(seq.ctrls.len(), keys.len());
+    assert!(seq.ctrls.iter().all(|c| c.value == 1));
+}
+
+#[test]
+fn remove_duplicates_matches_a_per_tick_rescan_on_mixed_ticks() {
+    // The straightforward per-tick rescan the indexed version replaced, kept as an oracle.
+    fn reference(mut ctrls: Vec<CtrlEvent>) -> Vec<CtrlEvent> {
+        ctrls.sort_by_key(|c| c.tick);
+        let key = |k: CtrlKind| match k {
+            CtrlKind::Cc(n) => (0, n),
+            CtrlKind::PitchBend => (1, 0),
+            CtrlKind::ChannelPressure => (2, 0),
+            CtrlKind::PolyPressure(p) => (3, p),
+            CtrlKind::Program => (4, 0),
+        };
+        let mut kept: Vec<CtrlEvent> = Vec::new();
+        for c in ctrls {
+            match kept.iter_mut().rev().take_while(|k| k.tick == c.tick).find(|k| k.channel == c.channel && key(k.kind) == key(c.kind)) {
+                Some(slot) => *slot = c,
+                None => kept.push(c),
+            }
+        }
+        kept
+    }
+
+    // Few ticks, channels and kinds, so the same key recurs both within a tick (interleaved with
+    // other keys) and across ticks; unsorted input from a fixed xorshift stream.
+    let mut state = 0x9E37_79B9_7F4A_7C15u64;
+    let mut next = move || {
+        state ^= state << 13;
+        state ^= state >> 7;
+        state ^= state << 17;
+        state
+    };
+    let kinds = |r: u64| match r % 5 {
+        0 => CtrlKind::Cc((r >> 8) as u8 % 4),
+        1 => CtrlKind::PitchBend,
+        2 => CtrlKind::ChannelPressure,
+        3 => CtrlKind::PolyPressure((r >> 8) as u8 % 4),
+        _ => CtrlKind::Program,
+    };
+    for round in 0..200 {
+        let mut ctrls = Vec::new();
+        for i in 0..(next() % 64) {
+            let r = next();
+            ctrls.push(CtrlEvent { tick: (r % 6) as i64 - 2, channel: (r >> 16) as u8 % 3, kind: kinds(r >> 24), value: (round * 100 + i) as i32 });
+        }
+        let mut seq = Sequence { notes: Vec::new(), ctrls: ctrls.clone() };
+        let removed = seq.remove_duplicates();
+        let expected = reference(ctrls.clone());
+        assert_eq!(seq.ctrls, expected, "round {round}");
+        assert_eq!(removed, ctrls.len() - expected.len(), "round {round}");
+    }
+}

crates/mix/src/offline.rs

@@ -131,60 +131,33 @@ pub fn fold_down_stereo(fmt: ChannelFormat, ch: &[Vec<f32>]) -> Vec<Vec<f32>> {
     out
 }
 
-/// Block size for clip effects in [`render_clips`].
-const CLIP_FX_BLOCK: usize = 4096;
-/// Most a clip effect keeps rendering past its clip's end in [`render_clips`], in seconds.
-const MAX_CLIP_FX_TAIL_SECONDS: f64 = 10.0;
-/// A tail block whose peak is below this (-180 dBFS) ends a clip effect's tail.
-const CLIP_FX_TAIL_FLOOR: f32 = 1e-9;
-
 /// Render only one track's clips (no mixer processing) — Consolidate.
 pub fn render_clips(s: &Session, track: TrackId, range: Range) -> Vec<Vec<f32>> {
     let Some(t) = s.track(track) else { return Vec::new() };
     let len = usize::try_from(range.len().max(0)).unwrap_or(0).min(MAX_RENDER_SAMPLES / t.channels().max(1));
     let mut out = vec![vec![0.0f32; len]; t.channels().max(1)];
     let mut scratch = Vec::new();
-    // One reusable block for every clip with effects.
-    let mut block: Vec<Vec<f32>> = Vec::new();
-    let max_tail = s.sample_rate.samples(MAX_CLIP_FX_TAIL_SECONDS).max(0);
     for c in t.clips().iter().filter(|c| !c.muted && c.range().overlaps(&range)) {
         match clip_fx_params(s, c.id.0) {
             None => render_clip(s, c, range.start, len, &mut out, &mut scratch),
             Some(params) => {
-                if block.len() != out.len() {
-                    block = vec![vec![0.0f32; CLIP_FX_BLOCK]; out.len()];
-                }
-                let mut fx = ClipFx::new(s.sample_rate.as_f64() as f32, out.len());
+                let mut tmp = vec![vec![0.0f32; len]; out.len()];
+                render_clip(s, c, range.start, len, &mut tmp, &mut scratch);
+                let mut fx = ClipFx::new(s.sample_rate.as_f64() as f32, tmp.len());
                 fx.configure(params);
-                // The effects start from silence, so nothing comes out before the clip starts:
-                // process from there through the clip and a bounded tail, not the whole selection.
-                let offset = |at: Samples| usize::try_from(at.saturating_sub(range.start).max(0)).unwrap_or(usize::MAX).min(len);
-                let first = offset(c.start);
-                let clip_end = offset(c.end());
-                let tail_end = offset(c.end().saturating_add(max_tail));
-                let mut done = first;
+                let mut done = 0;
                 while done < len {
-                    let n = (len - done).min(CLIP_FX_BLOCK);
-                    for ch in &mut block {
-                        ch.fill(0.0);
-                    }
-                    if done < clip_end {
-                        render_clip(s, c, range.start.saturating_add(done as i64), n, &mut block, &mut scratch);
-                    }
+                    let n = (len - done).min(4096);
+                    let mut block: Vec<Vec<f32>> = tmp.iter().map(|ch| ch.get(done..done + n).map(<[f32]>::to_vec).unwrap_or_default()).collect();
                     fx.process(&mut block, n);
-                    let mut peak = 0.0f32;
                     for (o, b) in out.iter_mut().zip(block.iter()) {
                         if let Some(dst) = o.get_mut(done..done + n) {
                             for (x, y) in dst.iter_mut().zip(b.iter()) {
                                 *x += *y;
-                                peak = peak.max(y.abs());
                             }
                         }
                     }
                     done += n;
-                    if done >= clip_end && (done >= tail_end || peak < CLIP_FX_TAIL_FLOOR) {
-                        break;
-                    }
                 }
             }
         }

crates/mix/src/tests.rs

@@ -1208,74 +1208,3 @@ fn gain_ramp_matches_converting_both_ends_every_sample() {
         }
     }
 }
-
-/// Consolidate's clip-effect pass, processing every clip's effects across the whole selection
-/// (what `render_clips` did before it limited them to the clip and its tail).
-fn render_clips_full_span(s: &Session, track: TrackId, range: Range) -> Vec<Vec<f32>> {
-    let t = s.track(track).unwrap();
-    let len = range.len() as usize;
-    let mut out = vec![vec![0.0f32; len]; t.channels().max(1)];
-    let mut scratch = Vec::new();
-    for c in t.clips().iter().filter(|c| !c.muted && c.range().overlaps(&range)) {
-        let params = crate::clips::clip_fx_params(s, c.id.0).unwrap();
-        let mut tmp = vec![vec![0.0f32; len]; out.len()];
-        crate::clips::render_clip(s, c, range.start, len, &mut tmp, &mut scratch);
-        let mut fx = crate::clips::ClipFx::new(48_000.0, tmp.len());
-        fx.configure(params);
-        for done in (0..len).step_by(4096) {
-            let n = (len - done).min(4096);
-            let mut block: Vec<Vec<f32>> = tmp.iter().map(|ch| ch[done..done + n].to_vec()).collect();
-            fx.process(&mut block, n);
-            for (o, b) in out.iter_mut().zip(&block) {
-                o[done..done + n].iter_mut().zip(b).for_each(|(x, y)| *x += y);
-            }
-        }
-    }
-    out
-}
-
-#[test]
-fn consolidate_clip_effects_cover_the_clip_and_its_tail() {
-    let fx_sets: [&[(&str, f64)]; 2] = [&[("comp.lookahead", 5.0), ("comp.threshold", -20.0), ("gain", -6.0)], &[("eq.hpf_on", 1.0), ("gain", 3.0)]];
-    for (k, params) in fx_sets.iter().enumerate() {
-        let mut s = Session::default();
-        let t = s.add_track(TrackKind::Audio, ChannelFormat::Mono, None);
-        s.pool.insert(SourceId(900), Arc::new(SourceAudio::new(AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.5; 4800]] })));
-        let cid = s.new_clip_id();
-        s.track_mut(t).unwrap().playlist_mut().unwrap().clips.push(Clip::audio(cid, "dc", SourceId(900), 0, 20_000, 4800));
-        for (param, value) in params.iter() {
-            s.edit.values.insert(format!("clip_fx.{}.{param}", cid.0), *value);
-        }
-        let range = Range::new(5_000, 100_000);
-        let got = render_clips(&s, t, range);
-        let want = render_clips_full_span(&s, t, range);
-        assert_eq!(got.len(), want.len());
-        assert!(want[0].iter().any(|x| x.abs() > 0.05), "the fixture should sound");
-        if k == 0 {
-            // The compressor's lookahead output after the clip's end is kept.
-            assert!(got[0][20_000 + 4800 - 5_000 + 10].abs() > 1e-3);
-        }
-        for (i, (a, b)) in got[0].iter().zip(&want[0]).enumerate() {
-            assert!((a - b).abs() < 1e-5, "set {k}, sample {i}: {a} vs {b}");
-        }
-    }
-}
-
-#[test]
-fn consolidate_many_tiny_effect_clips_stays_fast() {
-    // Thousands of one-sample clips with effects across a long selection: each one is processed
-    // over its own span, not the whole selection.
-    let mut s = Session::default();
-    let t = s.add_track(TrackKind::Audio, ChannelFormat::Mono, None);
-    s.pool.insert(SourceId(900), Arc::new(SourceAudio::new(AudioBuffer { sample_rate: 48_000, channels: vec![vec![0.5; 1]] })));
-    for i in 0..2000i64 {
-        let cid = s.new_clip_id();
-        s.track_mut(t).unwrap().playlist_mut().unwrap().clips.push(Clip::audio(cid, "x", SourceId(900), 0, i * 1000, 1));
-        s.edit.values.insert(format!("clip_fx.{}.gain", cid.0), -6.0);
-    }
-    let start = std::time::Instant::now();
-    let out = render_clips(&s, t, Range::new(0, 4_000_000));
-    assert!(start.elapsed() < std::time::Duration::from_secs(10), "{:?}", start.elapsed());
-    assert!((out[0][1000] - 0.5 * db_to_gain(-6.0)).abs() < 1e-6);
-    assert_eq!(out[0][1001], 0.0);
-}

packaging/linux/flatpak-bundle.sh

@@ -47,6 +47,12 @@ done
 
 echo "==> SoundCraft $VERSION Flatpak bundle for $ARCH from $(basename "$TARBALL")"
 
+# The packaged app unpacks to tens of MB; an archive that lists far more would fill the build
+# host's disk before anything here could check it.
+MAX_UNPACKED_BYTES=$((2 * 1024 * 1024 * 1024))
+UNPACKED="$(tar -tzvf "$TARBALL" | awk '{ s += $3 } END { print s + 0 }')"
+[ "$UNPACKED" -le "$MAX_UNPACKED_BYTES" ] || { echo "error: $TARBALL unpacks to $UNPACKED bytes, more than $MAX_UNPACKED_BYTES" >&2; exit 1; }
+
 WORK="$CARGO_TARGET_DIR/flatpak-bundle"
 rm -rf "$WORK"
 mkdir -p "$WORK/stage"

packaging/macos/import-cert.sh

@@ -19,10 +19,13 @@ fi
 
 TMP="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
 KEYCHAIN="$TMP/soundcraft-signing.keychain-db"
-CERT="$TMP/soundcraft-signing.p12"
+# The decoded certificate goes in a folder of this run's own (mktemp creates it, owner-only):
+# a name another account could plant in the shared folder must not receive or redirect it.
+CERT_DIR="$(mktemp -d "$TMP/soundcraft-signing.XXXXXX")"
+CERT="$CERT_DIR/soundcraft-signing.p12"
 KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}"
 
-trap 'rm -f "$CERT"' EXIT
+trap 'rm -rf "$CERT_DIR"' EXIT
 printf '%s' "$APPLE_CERTIFICATE" | base64 --decode >"$CERT"
 security create-keychain -p "$KC_PASS" "$KEYCHAIN"
 security set-keychain-settings -lut 21600 "$KEYCHAIN"