build(linux): avoid network for appstream cli & add missing deps

[HurricanePootis]

Description

As of right now, the PKGBUILD fails to build on Arch Linux due to AppStream throwing warnings when validating a file. Therefore, I have created a pull request to add --no-net to appstreamcli validate. Furthermore, when checking the ensuing package with namcap (a tool used by Arch maintainers), the package was missing gtk3, hicolor-icon-theme, and libayatana-appindicator. This is with building sunshine against the latest pre-release (2026.619.155209).

I believe appstream fails to validate due to these pages being behind Cloudflare, but that's just my guess.

Here is CLI output of the build failing without this commit:

W: dev.lizardbyte.app.Sunshine:20: url-not-reachable
     https://docs.lizardbyte.dev/projects/sunshine/latest/md_docs_2troubleshooting.html -
     Unexpected status code: 429
W: dev.lizardbyte.app.Sunshine:21: url-not-reachable
     https://docs.lizardbyte.dev/projects/sunshine - Unexpected status code: 429
I: dev.lizardbyte.app.Sunshine:26: description-first-word-not-capitalized

✘ Validation failed: warnings: 2, infos: 1, pedantic: 1
==> ERROR: A failure occurred in build().
    Aborting...
hurricane@TheCloutPC ~/sunshine/packaging/linux/Arch $ 

Screenshot

Issues Fixed or Closed

Roadmap Issues

Type of Change

• feat: New feature (non-breaking change which adds functionality)
• fix: Bug fix (non-breaking change which fixes an issue)
• docs: Documentation only changes
• style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
• refactor: Code change that neither fixes a bug nor adds a feature
• perf: Code change that improves performance
• test: Adding missing tests or correcting existing tests
• build: Changes that affect the build system or external dependencies
• ci: Changes to CI configuration files and scripts
• chore: Other changes that don't modify src or test files
• revert: Reverts a previous commit
• BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

• Code follows the style guidelines of this project
• Code has been self-reviewed
• Code has been commented, particularly in hard-to-understand areas
• Code docstring/documentation-blocks for new or existing methods/components have been added or updated
• Unit tests have been added or updated for any new or modified functionality

AI Usage

• None: No AI tools were used in creating this PR
• Light: AI provided minor assistance (formatting, simple suggestions)
• Moderate: AI helped with code generation or debugging specific parts
• Heavy: AI generated most or all of the code changes

[ReenigneArcher]

W: dev.lizardbyte.app.Sunshine:20: url-not-reachable
https://docs.lizardbyte.dev/projects/sunshine/latest/md_docs_2troubleshooting.html -
Unexpected status code: 429
W: dev.lizardbyte.app.Sunshine:21: url-not-reachable
https://docs.lizardbyte.dev/projects/sunshine - Unexpected status code: 429

These are transient errors. I'd rather not disable network altogether.

[HurricanePootis]

These "transient errors" cause makepkg to completely fail at building the PKGBUILD. These URLs are reachable via browser, but appstreamcli seems to be blocked from accessing it, most likely (based on my experience) Cloudflare's protection.

[ReenigneArcher]

We test it in CI on every PR run. It does fail sometimes, but not very often.

[HurricanePootis]

Maybe Cloudflare is not blocking the CI servers from accessing the website, but it is being blocked on my network.

I just enabled Cloudflare WARP on my system and was able to build this project without my commit:

-- Build files have been written to: /home/hurricane/sunshine/packaging/linux/Arch/src/build
I: dev.lizardbyte.app.Sunshine:26: description-first-word-not-capitalized

✔ Validation was successful: infos: 1, pedantic: 1
build/dev.lizardbyte.app.Sunshine.metainfo.xml: OK

Thus, proving cloudflare is blocking certain networks from running appstream cli properly. Since this PKGBUILD is also hosted on the AUR and other places, I think it would be best just to disable the network all together. Or, at least have a way to check to see if cloudflare is blocking the site on someone's PC.

[ReenigneArcher]

Can you add the new argument when GITHUB_ACTIONS env variable is not set?

[HurricanePootis]

Can you add the new argument when GITHUB_ACTIONS env variable is not set?

Done!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Bundle Report

Bundle size has no change ✅

[ReenigneArcher]

Are we not using namcap correctly here?

Sunshine/.github/workflows/ci-archlinux.yml

Line 133 in 3437a0b

sudo -u builder namcap -i PKGBUILD

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.43%. Comparing base (3437a0b) to head (09af759).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #5363      +/-   ##
==========================================
- Coverage   27.45%   27.43%   -0.02%     
==========================================
  Files         113      113              
  Lines       25554    25554              
  Branches    11244    11244              
==========================================
- Hits         7016     7011       -5     
- Misses      14571    16453    +1882     
+ Partials     3967     2090    -1877     

Flag	Coverage Δ
Archlinux	0.00% <ø> (ø)
FreeBSD-aarch64	?
FreeBSD-amd64	13.24% <ø> (+<0.01%)	⬆️
Homebrew-macos-14	21.01% <ø> (+<0.01%)	⬆️
Homebrew-macos-15	21.17% <ø> (ø)
Homebrew-macos-26	21.31% <ø> (+0.01%)	⬆️
Homebrew-ubuntu-24.04	13.00% <ø> (ø)
Linux-AppImage	12.34% <ø> (ø)
Windows-AMD64	15.26% <ø> (ø)
Windows-ARM64	13.31% <ø> (-0.01%)	⬇️
macOS-arm64	19.27% <ø> (ø)
macOS-x86_64	18.75% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 57 files with indirect coverage changes

[HurricanePootis]

Are we not using namcap correctly here?

Sunshine/.github/workflows/ci-archlinux.yml

Line 133 in 3437a0b

sudo -u builder namcap -i PKGBUILD

Running namcap on the PKGBUILD vs the *.pkg.tar.zst produces different results.

For example:

hurricane@TheCloutPC ~/sunshine/packaging/linux/Arch $ namcap -i PKGBUILD 
PKGBUILD (sunshine) W: VCS source PKGBUILD needs additional makedepends 'git' to work properly
PKGBUILD (sunshine) W: Missing Maintainer tag
PKGBUILD (sunshine) I: Missing Contributor tag
hurricane@TheCloutPC ~/sunshine/packaging/linux/Arch $ namcap sunshine-2026.619.155209-1-x86_64.pkg.tar.zst 
sunshine W: Dependency wayland detected and implicitly satisfied (libraries ['usr/lib/libwayland-client.so.0'] needed in files ['usr/bin/sunshine'])
sunshine W: Dependency glib2 detected and implicitly satisfied (libraries ['usr/lib/libgobject-2.0.so.0', 'usr/lib/libgio-2.0.so.0', 'usr/lib/libglib-2.0.so.0'] needed in files ['usr/bin/sunshine'])
sunshine W: Dependency icu detected and implicitly satisfied (libraries ['usr/lib/libicuuc.so.78'] needed in files ['usr/bin/sunshine'])
sunshine W: Dependency mesa detected but optional (libraries ['usr/lib/libgbm.so.1'] needed in files ['usr/bin/sunshine'])
sunshine W: Dependency glibc detected and implicitly satisfied (libraries ['usr/lib/libm.so.6', 'usr/lib/libmvec.so.1', 'usr/lib/ld-linux-x86-64.so.2', 'usr/lib/libc.so.6'] needed in files ['usr/bin/sunshine'])
sunshine W: Dependency included, but may not be needed ('avahi')
sunshine W: Dependency included, but may not be needed ('libmfx')
sunshine W: Dependency included, but may not be needed ('libx11')
sunshine W: Dependency included, but may not be needed ('libxcb')
sunshine W: Dependency included, but may not be needed ('libxfixes')
sunshine W: Dependency included, but may not be needed ('libxrandr')
sunshine W: Dependency included, but may not be needed ('libxtst')
sunshine W: Dependency included, but may not be needed ('qt6-base')
sunshine W: Dependency included, but may not be needed ('qt6-svg')
sunshine W: Dependency included, but may not be needed ('udev')
sunshine W: Dependency included, but may not be needed ('which')
hurricane@TheCloutPC ~/sunshine/packaging/linux/Arch $ 

The actual sunshine packages seems to have a lot of unnecessary dependencies, and is also not explicitly reliant on wayland, glib2, icu, mesa, and glibc. I assumed y'all knew about this version of namcap output, so I only fixed any E (for errors). I didn't touch any of the warning stuff since namcap usually can't check for dependencies if y'all are doing dlopen or are calling an executable directly from your program.

Me personally, I try to remove all the warnings on my PKGBUILD, but as long as there are no errors, it's like whatever.