Who makes WaveFlow, and how it ships

Who makes it

1. 01

   Every change says what it is

   Each change is recorded with a conventional commit message. A release bot reads them, works out the next version number and opens a release pull request that bumps every version file and writes the changelog.

2. 02

   A person decides

   Nothing ships until the maintainer reviews and merges that pull request. The merge tags the version and opens its release on GitHub.

3. 03

   Built in the open

   GitHub's build machines make every installer from that tag, with public logs: Linux on a pinned Ubuntu 24.04, checked against the oldest system library it needs, Windows, and one macOS build for both Intel and Apple silicon.

4. 04

   Signed, and checked before it installs

   Each update is signed with the project's own key, and the signature names its version. The app checks both before it installs anything, and refuses a file that was altered or relabelled.

5. 05

   Two places to download from

   Since the 2.0 betas, every file is also copied to download.waveflow.app. The app asks both hosts and keeps the newest signed version, so one of them going down stops no update.

6. 06

   Package managers follow

   Once the release is out, workflows update winget, the AUR, Fedora Copr and the APT repository on their own. A ready copy of the release pipeline for GitLab sits in the player's, the server's and QuickPlay's repositories, so losing GitHub would cost hours, not a rewrite.

• Not a streaming service

  WaveFlow plays the music files you own. There is no catalogue to rent and nothing to subscribe to.

• No account to create

  The player and QuickPlay work without signing in anywhere. A WaveFlow Server account lives on your own server, and Last.fm or ListenBrainz are there only if you connect them.

• No telemetry

  The apps report nothing about how you use them. Some features do go online, such as covers, lyrics and the update check: the player's privacy policy lists each one, and Offline mode cuts them at once.

• No ads, no paid tier

  Every app is free, with nothing held back for a paying version.

• No phone app in the stores yet

  The Android and iPhone apps are in development, in public repositories. Neither has a published build.

• Not all open source

  The player, the server, QuickPlay and the phone apps are. Tempora's code is not public yet, and some plugins are closed source.

• Not from a recognised publisher yet

  Windows builds are signed with a self-signed certificate and macOS builds are not notarized, so both systems may warn you the first time you open WaveFlow.