LibreOffice

XerisOS exposes the complete LibreOffice 26.8.0 suite as six focused Apps tiles: Writer, Calc, Impress, Draw, Math, and Base. The same upstream program tree powers every tile. The native XerisOS Calculator remains a separate app.

The full suite requires a computer or virtual machine with at least 8 GB of RAM. The core XerisOS desktop can boot with less, but a 4 GB validation run exhausted the application file-buffer arena while Writer was active. The Apps launcher checks the UEFI memory report before it reads the Office payload. A machine below the supported class receives a clear requirement instead of spending minutes loading an application that cannot finish starting.

On a live USB, disposable XDG and fontconfig caches are kept in RAM and fontconfig scans only the packaged font directories. The LibreOffice profile stays under /USER/LIBREOFFICE, and documents stay under /USER, so the preferences and saved work remain persistent. A sanitized, version-matched profile seed supplies the bundled-extension registry during factory setup, so a new computer does not spend its first Writer launch rebuilding that cache. The launch card acknowledges the click before storage work, prevents duplicate launches, reports loading phases and elapsed time, and offers specific recovery for storage, memory, and startup failures.

What is pinned#

tools/libreoffice/VERSION.json pins the official Linux x86-64 DEB archive, its SHA-256 digest, and the corresponding source archive. The large downloaded archive and expanded application files are release products and must not be committed to Git.

tools/libreoffice/runtime-jammy.tsv pins the Ubuntu 22.04 amd64 packages used for the suite's GTK 3/Wayland runtime. Every row records the binary package, version, source package, Ubuntu pool path, byte size, and SHA-256 digest.

Reproduce the application tree#

Run this from the repository root after downloading the archive named in VERSION.json:

python3 tools/libreoffice/package.py \
  --archive work/libreoffice-download/LibreOffice_26.8.0_Linux_x86-64_deb.tar.gz \
  --out work/libreoffice-stage

The tool rejects an archive whose digest differs from the pin, safely reads all 42 Debian packages without invoking dpkg, rejects FAT-incompatible or case-colliding paths, and creates work/libreoffice-stage/OFFICE. That tree contains the full suite, upstream license and notice files, factual source and redistribution information, package provenance, a dependency audit, and a SHA-256 manifest.

Reproduce the Linux runtime#

python3 tools/libreoffice/runtime.py \
  --cache work/libreoffice-runtime-cache \
  --out work/libreoffice-runtime-stage \
  --jobs 6

The tool downloads only the pinned Ubuntu packages over HTTPS, checks every size and SHA-256 value, and creates work/libreoffice-runtime-stage/RUNTIME-PAYLOAD. It flattens ELF shared objects to the layout expected by XerisOS while preserving GTK, GLib, font, icon, MIME, and Wayland support data. OFFICE-RUNTIME/ inside the output holds package notices, exact source mappings, redistribution information, and the runtime manifest.

Assemble the USB and installer payload#

Merge both generated outputs into the same xerisos directory:

xerisos/
  OFFICE/                 <- contents of libreoffice-stage/OFFICE
  OFFICE-PROFILE/         <- sanitized first-launch profile seed
  LD.SO                   <- from RUNTIME-PAYLOAD
  libc.so.6               <- from RUNTIME-PAYLOAD
  libgtk-3.so.0            <- from RUNTIME-PAYLOAD
  ...                     <- all other RUNTIME-PAYLOAD contents
  OFFICE-RUNTIME/         <- runtime notices, sources, and manifest

Copy the contents of RUNTIME-PAYLOAD, not the directory as one nested folder. The XerisOS loader resolves Linux libraries from the payload root. Both the live USB builder and the installed-system payload must receive the same two trees. Do not publish a USB containing OFFICE/ without its matching runtime.

tools/release_usb.py stage includes assets/libreoffice-profile by default. It rejects a stale seed, transient state, recent files, personal paths, or a profile that does not contain the real bundled-extension cache. The same seed works on live media and installed systems because all internal extension references use LibreOffice's $BUNDLED_EXTENSIONS variables.

The Apps drawer checks the suite core, provenance, legal files, loader, and the essential GTK/Wayland libraries before launching. A partial image therefore shows a repair message instead of attempting an unsafe launch.

Verification status#

The packaging tests validate archive handling, manifests, pins, and failure behavior. The current audited startup closure contains 35 LibreOffice-bundled ELFs and 99 runtime ELFs, with 557 dependency edges and no missing SONAMEs. All 33 staged GTK/GIO/GDK module ELFs also have their direct dependencies.

This proves that the required files are present; it does not prove that the suite runs correctly on XerisOS. The OS's Linux ABI and minimal Wayland compositor still need a real boot or QEMU launch test for Writer, Calc, Impress, Draw, Math, and Base. In particular, complex applications can expose missing syscalls or Wayland protocol behavior even when the ELF closure is complete. Base database engines, Java macros, extensions, printing, and import or export filters need separate functional checks; Base's Java-dependent features also require the separately staged JAVA25 runtime. Keep this limitation in release notes until all six modes have been opened, edited, saved, reopened, and closed on the release image.

Run the focused source checks with:

python3 tools/libreoffice/test_package.py
python3 tools/libreoffice/test_runtime.py

Wireless installation and release gate#

The Apps tiles can fetch a missing or damaged Office suite from the signed office component. It installs the suite and its matching runtime together under /xerisos, leaving the browser's root libraries alone. The bundle is roughly 883 MB across 22,148 files, so a first install needs substantial free space and may take a while on Wi-Fi. The updater verifies the signed catalog, the signed bundle manifest, and every downloaded file's SHA-512 before writing its version marker. Opening a tile after a completed install launches Office.

The release host first stages the pinned trees above, then runs:

mingw32-make -f tools/component.mk office-check
mingw32-make -f tools/component.mk office-prepare

comp_office_payload/ is an unsigned, ignored build product. The private Ed25519 key is never stored in this repository. A release operator signs it locally with tools/xeris_update_sign.py --payload comp_office_payload --version 26.8.0 --slot component --key <private-key-path> --out comp_office_out. The key's public half must match src/net/xeris_update_pubkey.h; creating a different key without updating the installed OS will make the bundle unusable.

Do not upload the binary bundle yet solely because the payload audit passes. The Document Foundation's licensing page says LibreOffice is primarily MPL 2.0 and includes other licensed software. The Ubuntu runtime has package-specific terms, including GPL and LGPL packages. OFFICE/LICENSE, OFFICE/NOTICE, OFFICE/CREDITS.fodt, OFFICE/SOURCE-OFFER.txt, and the runtime's OFFICE-RUNTIME/LICENSES/, PACKAGES.tsv, SOURCES.tsv, and LICENSE-MAPPING.tsv are mandatory in the bundle. The two SOURCE-OFFER.txt files identify upstream source locations; they explicitly are not written offers from Xeris. Before binary publication, review every package's terms and provide the exact corresponding source in the form and for the period each license requires. For GPLv2 packages, a link to someone else's source page alone does not replace the source or a qualifying written offer. Put clear source-download directions beside the hosted binary and retain the material for the applicable period. Also review LibreOffice and Ubuntu trademark use; do not imply their endorsement of XerisOS. This is a release gate, not a claim of legal certification.

The source mirror is prepared from the exact Ubuntu Sources.gz records and The Document Foundation's matching LibreOffice source archive. The source download tool checks the published SHA-256 for every archive, then creates a human-readable index and inventory. The wireless payload adds OFFICE/SOURCE-ACCESS.txt with the public index URL:

python tools/libreoffice/source_inventory.py --download
python tools/libreoffice/upload_sources.py --check-only
python tools/libreoffice/upload_sources.py

Verify the public corresponding-source index and representative archive downloads before the binary upload.

After source access and release review, the operator may run:

mingw32-make -f tools/component.mk office-upload OFFICE_VERSION=26.8.0 OFFICE_SOURCE_REVIEWED=1
mingw32-make -f tools/component.mk office-verify OFFICE_VERSION=26.8.0
mingw32-make -f tools/component.mk components-manifest OFFICE_VERSION=26.8.0 KEY=<private-key-path>

The first command uploads all payload files to the configured R2 bucket, placing manifest.sig and then manifest.txt last. office-verify checks public URLs. The final command opts the Office entry into the signed catalog; without OFFICE_VERSION, new images continue to omit it. An existing Beelink also needs the rebuilt kernel and signed COMPONENTS.TXT/COMPONENTS.sig through the normal system-update channel before its Apps tiles can fetch this component. Do not send an unsigned catalog or an untested kernel as an OTA.

The 26.8.0 bundle contains 22,148 files. Downloading each over a separate connection gives impractical first-use times on XerisOS. The fast-pack transport groups those exact signed files into 15 objects, while the guest still verifies the signed manifest and every file's SHA-512 before installation. To reproduce the transport files from the already-signed bundle and publish them:

python tools/libreoffice/pack_component.py
python tools/libreoffice/test_pack_component.py
python tools/libreoffice/upload_packs.py

PACKS.TXT is published last and is transport metadata, not a signing key or a replacement for manifest.sig. The fast-pack kernel must be installed before starting Office; older kernels still download the files individually.