feat(linux): ship a Flatpak bundle with each release by AalmanSadath · Pull Request #957 · AprilNEA/OpenLogi

AalmanSadath · 2026-08-25T02:05:26Z

Summary

Adds a .flatpak bundle per architecture to the release assets, beside the
.deb/.rpm/.pkg.tar.zst already there. One new job in the existing build
matrix, and four small edits to release.yml to attach what it produces.

It deliberately stops there. A bundle is a one-time install: there is no remote
behind it, so flatpak update has nothing to check. Closing that needs a
repository to host, sign and keep alive, which is a bigger decision than adding
a build artifact, #767 proposes exactly that, and this PR is the subset that
does not commit you to any of it.

Changes

packaging/linux/flatpak/ (new)

org.openlogi.OpenLogi.yml — freedesktop 25.08 runtime, llvm20 SDK
extension (openlogi-camera pulls v4l2-sys-mit, whose build script runs
bindgen and dlopens libclang; the base SDK ships none), and rustup rather than
Sdk.Extension.rust-stable, because the extension trails rust-version and
cargo refuses outright when it does. Source is type: dir of the checkout, so
a release builds exactly the tagged tree.
org.openlogi.OpenLogi.metainfo.xml — AppStream, required for software
centres to list the app. There is none in the tree today.
org.openlogi.OpenLogi.desktop — Flatpak requires the entry to be named for
the application ID, which packaging/linux/desktop/openlogi.desktop is not.

Permissions worth reviewing: --device=all is the only one covering both
/dev/hidraw* and /dev/uinput — --device=input covers neither. It grants a
path to those nodes, not DAC permission; the host still needs
70-openlogi.rules, exactly as the .deb does. --share=network is for the
device render images. Solaar carries the same --device=all on Flathub for the
same reason.

.github/workflows/build.yml

New linux-flatpak job, matrix amd64/arm64 on the same runners as
linux-packages, wired into results and the workflow_call outputs.
Separate from linux-packages on purpose: it compiles the workspace again
inside the Flatpak SDK, where the runner's rust-cache cannot reach, so folding
them together would lose the .deb whenever the Flatpak build failed.
AppStream is stamped from the tree — version from the workspace, date from the
commit — never from an input, so a rebuild of an old tag cannot claim to have
been released the day it was rebuilt.

.github/workflows/release.yml

Downloads OpenLogi-linux-flatpak-*, adds *.flatpak to SHA256SUMS, adds
flatpak to the best-effort detection loop, and adds the conditional entry to
softprops' files. It rides the existing degradation path: publish gates only
on macos_result, so a failed Flatpak leg costs the bundle, not the release.

README.md — the Flatpak bundle in the Linux section, with the host udev
setup as one command.

Testing

Dispatched Release on the branch (publish skipped, ref_type != 'tag'):

linux-flatpak (amd64) — pass
linux-flatpak (arm64) — pass
linux-packages — pass; macOS/Windows legs fail in a fork for want of signing
secrets, which is expected and unrelated

Locally, from the repository root:

flatpak-builder --user --disable-rofiles-fuse --force-clean \
  --repo=repo --default-branch=stable \
  build packaging/linux/flatpak/org.openlogi.OpenLogi.yml
flatpak build-bundle --runtime-repo=https://dl.flathub.org/repo/flathub.flatpakrepo \
  repo out.flatpak org.openlogi.OpenLogi stable
appstreamcli validate packaging/linux/flatpak/org.openlogi.OpenLogi.metainfo.xml
desktop-file-validate packaging/linux/flatpak/org.openlogi.OpenLogi.desktop

Both exit 0 in ~10 minutes; metainfo and desktop validate. Re-imported the
bundle and confirmed the contents: all four binaries, the stamped version,
70-openlogi.rules, every icon size, and the runtime repo embedded.

Installed the amd64 CI artifact on Fedora 44 — flatpak list shows it at
0.7.10. device access depends on the host udev rules, which that machine already had.

The release.yml half is not exercised by any of the above, because publish
needs a tag and a successful macOS leg, which a fork cannot produce. I ran its
shell against a fabricated dist/ instead: with bundles present both land in
SHA256SUMS and flatpak=true; with the leg failed, checksums still generate
and flatpak=false, so fail_on_unmatched_files does not trip.

Notes for review

CI will not build this on the PR. should-build returns false for
pull_request without the needs: build label, so a green check here has not
run the new job. Worth labelling before judging it.
publish has needs: build, so a release now waits for the Flatpak legs even
though it does not depend on them. Measured ~15 minutes cold on
ubuntu-latest; timeout-minutes: 45 is a hang bound, not an estimate.
The bundle's origin ends up named after the file, so the release filename is
user-visible in flatpak list, not only on the release page.

Fix #371

The .deb/.rpm/.pkg.tar.zst cover the distributions that use them, and leave out the ones that use neither: the immutable distributions especially, where Flatpak is simply how software is installed. This adds a single-file .flatpak bundle per architecture to the release assets, beside the packages already there. A bundle is a one-time install rather than a subscription, since there is no remote for `flatpak update` to check. That is the deliberate limit of this change: closing it needs a repository to host and sign, which is a bigger decision than adding a build artifact, and it can be taken later without undoing any of this. The build is its own leg rather than part of linux-packages. It compiles the workspace again inside the Flatpak SDK, where the runner's rust-cache cannot reach, so folding it in would tie a thirty-minute job to an hour-long one and lose the .deb whenever the Flatpak build failed. It rides the same best-effort path as the Windows and Linux package legs: a failure costs the bundle, not the release. AppStream is stamped from the tree being built, never from an input. The version comes from the workspace and the date from the commit, so a rebuild of an old tag cannot claim to have been released the day it was rebuilt, and the label cannot drift from the binaries it names. Verified locally end to end: flatpak-builder and build-bundle both exit 0, and the resulting 23 MB bundle imports with all four binaries, the stamped version, the udev rules, every icon size and the runtime repo embedded.

The Linux section listed the three package formats and nothing for the distributions that use none of them, which is the gap the bundle exists to fill. Host setup is one command rather than the usual block. The rules are read out of the installed application, so it needs no checkout and no cloned repository, and nothing extra is needed for /dev/uinput: the rules already create its node with static_node=uinput and opening it loads the module, which is why no packaging here ships a modules-load.d entry either. Also says what the bundle is not. There is no remote behind it, so `flatpak update` has nothing to check, and the agent is launched by the application rather than by a user service — so the systemctl line below it does not apply. Verified the one-liner against an installed bundle: it reproduces the tracked rules file byte for byte.

greptile-apps · 2026-08-25T02:08:17Z

Greptile Summary

The PR adds amd64 and arm64 Flatpak bundles to the Linux build and release pipeline.

Builds the complete OpenLogi application set inside the Freedesktop SDK.
Adds Flatpak desktop and AppStream metadata plus host udev setup instructions.
Checksums, minisign-signs, uploads, and publishes successful Flatpak artifacts alongside existing packages.
The previously reported signature omission is fixed: .flatpak files are now included in the signing loop.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously omitted Flatpak signature is now generated and verified before release publication.

Important Files Changed

Filename	Overview
.github/workflows/build.yml	Adds native amd64 and arm64 Flatpak builds, artifact uploads, and reusable-workflow result reporting.
.github/workflows/release.yml	Integrates Flatpak bundles into checksum generation, minisign signing, R2 upload, and conditional GitHub Release publication.
packaging/linux/flatpak/org.openlogi.OpenLogi.yml	Defines the Flatpak runtime, permissions, complete application payload, and desktop integration.
README.md	Documents bundle installation, lack of automatic updates, and required host udev setup.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  S[Tagged source tree] --> B[Flatpak build matrix]
  B --> A[Architecture-specific bundles]
  A --> D[Release artifact download]
  D --> C[SHA256SUMS]
  D --> M[Minisign signing and verification]
  C --> R[GitHub Release and R2]
  M --> R

_{Reviews (2): Last reviewed commit: "fix(ci): sign the Flatpak bundles like e..." | Re-trigger Greptile}

The minisign loop covers the DMGs, the Windows zip/msi and all three Linux package formats, and its own comment says why: manual verification today, and the future auto-updaters need a detached signature to exist for every shipped version. The bundle was left out of it. That mattered in two places, not one. It is attached to the GitHub Release, and the R2 step copies dist/ wholesale, so the bundle was already being published to both without a .minisig beside it — the one installer a user could not verify. The signatures themselves need no further wiring: dist/*.minisig is already listed unconditionally in the release assets and R2 excludes only latest.json and the exes. Reported by Greptile on AprilNEA#957.

davidbudnick · 2026-08-25T03:33:40Z

Duplicate of #767 closing.

The minisign loop covers the DMGs, the Windows zip/msi and all three Linux package formats, and its own comment says why: manual verification today, and the future auto-updaters need a detached signature to exist for every shipped version. The bundle was left out of it. That mattered in two places, not one. It is attached to the GitHub Release, and the R2 step copies dist/ wholesale, so the bundle was already being published to both without a .minisig beside it — the one installer a user could not verify. The signatures themselves need no further wiring: dist/*.minisig is already listed unconditionally in the release assets and R2 excludes only latest.json and the exes. Reported by Greptile on AprilNEA#957.

AalmanSadath added 2 commits August 25, 2026 11:20

AalmanSadath requested a review from AprilNEA as a code owner August 25, 2026 02:05

davidbudnick added type: feature New feature request platform: all Cross-platform issue labels Aug 25, 2026

davidbudnick closed this Aug 25, 2026

Navigation Menu

Uh oh!

feat(linux): ship a Flatpak bundle with each release - #957

feat(linux): ship a Flatpak bundle with each release#957
AalmanSadath wants to merge 3 commits into
AprilNEA:masterfrom
AalmanSadath:feat/linux-flatpak-bundle

AalmanSadath commented Aug 25, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Aug 25, 2026 •

edited

Loading

Important Files Changed

Flowchart

Uh oh!

davidbudnick commented Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

AalmanSadath commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

Notes for review

Uh oh!

greptile-apps Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

davidbudnick commented Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AalmanSadath commented Aug 25, 2026 •

edited

Loading

greptile-apps Bot commented Aug 25, 2026 •

edited

Loading