Linux: official Flatpak + self-hosted Flatpak repo (then Flathub) for distros without AUR/.deb

sky_line commented

2026-10-04 07:21:20 +00:00

Owner

Ship an official Flatpak of Slipstream, to cover Linux distributions not served by the Arch PKGBUILD/AUR or the .deb: Fedora, openSUSE, Silverblue/Kinoite/Bazzite and other immutable distros, Steam Deck (SteamOS desktop mode), Solus, NixOS (non-flake users), etc. A user has already made their own Flatpak, which suggests demand; an official one avoids broken unofficial builds (see the Firestorm chat-import report, which was sandbox access).

Build

Manifest in-repo, e.g. scripts/packaging/flatpak/org.slipstreamviewer.Slipstream.yml. Pick the reverse-DNS ID from our domain.
Runtime: org.freedesktop.Platform (current 24.08 or newer) + org.freedesktop.Platform.GL.default (Mesa/NVIDIA via the GL extension; Vulkan ICDs come through it as well).
Repackage the CI-built tarball inside the manifest (type: archive, our release URL + sha256), rather than rebuilding from source in flatpak-builder. Same binary as the tarball; check glibc/libstdc++ against the runtime (glibc-check style).
Bundle or verify everything the tarball expects: CEF (dullahan) + its deps, libdecor + plugin, VLC/GStreamer media plugins (or the runtime's codecs extension), PipeWire/PulseAudio, libsecret if used, WebRTC voice.
.desktop file, AppStream metainfo (screenshots, release notes from releases.yml), icons.

Sandbox permissions (finish-args), minimal but working

--socket=wayland, --socket=fallback-x11, --share=ipc, --device=dri, --share=network, --socket=pulseaudio
Our data dir: XDG/~/.var/app is automatic; decide whether to keep ~/.slipstreamviewer (needs --persist=.slipstreamviewer) so data matches the tarball install.
Viewer import needs read access to other viewers' folders: --filesystem=~/.firestorm_x64:ro, ~/.secondlife:ro, ~/.alchemyviewer:ro, ... (and other viewers' Flatpak data under ~/.var/app if feasible). Pair with the importer's sandbox detection and hint.
Snapshots / uploads: use the file chooser portal (xdg-desktop-portal); check SDL/our file pickers go through it, else grant xdg-pictures/xdg-download.
Links: open via the OpenURI portal.
Game controllers / 3D mice if supported (--device=all only if really needed).

Hosting / distribution

Option A (recommended first): our own Flatpak repo, hosted on our infra, so we control release timing and can ship betas.

CI job on tag: flatpak-builder --repo=repo, GPG-sign, flatpak build-update-repo --generate-static-deltas, rsync to the website edge (e.g. https://flatpak.slipstreamviewer.org/repo/) the same way the website deploys.
Publish a .flatpakrepo file (repo URL + GPG key) and a .flatpakref per channel (stable / beta branches), so users can run:
flatpak install https://slipstreamviewer.org/slipstream.flatpakref
Updates then arrive through flatpak update / GNOME Software / Discover automatically.

Option B (later): Flathub.

Widest reach (enabled by default on Fedora, Mint, Steam Deck, ...). Requires a Flathub-reviewed manifest, building from Flathub's builders (source or extra-data of our tarball), their permission review (filesystem access for import may be challenged), and a release delay for review.
Betas could stay on our repo while stable goes to Flathub.

Website / docs

Add a Flatpak button + one-line install command on the Linux download card (next to .deb and PKGBUILD), and a wiki install page (including how to grant extra filesystem access for the importer).

Done when

A tag produces a signed Flatpak in our repo; a clean Fedora 43 and a Steam Deck can install it via the .flatpakref, log in, render (Vulkan on Mesa and NVIDIA), play media/voice, open web profiles, save snapshots, and import from a tarball Firestorm.

Ship an official **Flatpak** of Slipstream, to cover Linux distributions not served by the Arch PKGBUILD/AUR or the .deb: Fedora, openSUSE, Silverblue/Kinoite/Bazzite and other immutable distros, Steam Deck (SteamOS desktop mode), Solus, NixOS (non-flake users), etc. A user has already made their own Flatpak, which suggests demand; an official one avoids broken unofficial builds (see the Firestorm chat-import report, which was sandbox access). ### Build - Manifest in-repo, e.g. `scripts/packaging/flatpak/org.slipstreamviewer.Slipstream.yml`. Pick the reverse-DNS ID from our domain. - Runtime: `org.freedesktop.Platform` (current 24.08 or newer) + `org.freedesktop.Platform.GL.default` (Mesa/NVIDIA via the GL extension; Vulkan ICDs come through it as well). - Repackage the CI-built tarball inside the manifest (type: archive, our release URL + sha256), rather than rebuilding from source in flatpak-builder. Same binary as the tarball; check glibc/libstdc++ against the runtime (glibc-check style). - Bundle or verify everything the tarball expects: CEF (dullahan) + its deps, libdecor + plugin, VLC/GStreamer media plugins (or the runtime's codecs extension), PipeWire/PulseAudio, libsecret if used, WebRTC voice. - `.desktop` file, AppStream metainfo (screenshots, release notes from releases.yml), icons. ### Sandbox permissions (finish-args), minimal but working - `--socket=wayland`, `--socket=fallback-x11`, `--share=ipc`, `--device=dri`, `--share=network`, `--socket=pulseaudio` - Our data dir: XDG/`~/.var/app` is automatic; decide whether to keep `~/.slipstreamviewer` (needs `--persist=.slipstreamviewer`) so data matches the tarball install. - **Viewer import** needs read access to other viewers' folders: `--filesystem=~/.firestorm_x64:ro`, `~/.secondlife:ro`, `~/.alchemyviewer:ro`, ... (and other viewers' Flatpak data under `~/.var/app` if feasible). Pair with the importer's sandbox detection and hint. - Snapshots / uploads: use the file chooser portal (`xdg-desktop-portal`); check SDL/our file pickers go through it, else grant `xdg-pictures`/`xdg-download`. - Links: open via the OpenURI portal. - Game controllers / 3D mice if supported (`--device=all` only if really needed). ### Hosting / distribution **Option A (recommended first): our own Flatpak repo**, hosted on our infra, so we control release timing and can ship betas. - CI job on tag: `flatpak-builder --repo=repo`, GPG-sign, `flatpak build-update-repo --generate-static-deltas`, rsync to the website edge (e.g. `https://flatpak.slipstreamviewer.org/repo/`) the same way the website deploys. - Publish a `.flatpakrepo` file (repo URL + GPG key) and a `.flatpakref` per channel (stable / beta branches), so users can run: `flatpak install https://slipstreamviewer.org/slipstream.flatpakref` - Updates then arrive through `flatpak update` / GNOME Software / Discover automatically. **Option B (later): Flathub.** - Widest reach (enabled by default on Fedora, Mint, Steam Deck, ...). Requires a Flathub-reviewed manifest, building from Flathub's builders (source or extra-data of our tarball), their permission review (filesystem access for import may be challenged), and a release delay for review. - Betas could stay on our repo while stable goes to Flathub. ### Website / docs - Add a Flatpak button + one-line install command on the Linux download card (next to .deb and PKGBUILD), and a wiki install page (including how to grant extra filesystem access for the importer). ### Done when - A tag produces a signed Flatpak in our repo; a clean Fedora 43 and a Steam Deck can install it via the .flatpakref, log in, render (Vulkan on Mesa and NVIDIA), play media/voice, open web profiles, save snapshots, and import from a tarball Firestorm.

sky_line added the

feature

platform

labels

2026-10-04 07:21:20 +00:00

sky_line referenced this issue

2026-10-04 07:22:37 +00:00

Windows: Authenticode code signing for the viewer and installer (SmartScreen / AV) #287

sky_line referenced this issue

2026-10-04 07:22:37 +00:00

Linux: signed releases (SHA256SUMS + signature), signed apt repo, signed Arch/Flatpak artifacts #288

sky_line commented

2026-10-04 07:22:43 +00:00

Author

Owner

Signing: the self-hosted Flatpak repo GPG signing is tracked with the other Linux signing in #288 (Windows: #287).

sky_line referenced this issue

2026-10-04 07:22:43 +00:00

Windows: Authenticode code signing for the viewer and installer (SmartScreen / AV) #287

sky_line referenced this issue

2026-10-04 07:22:43 +00:00

Linux: signed releases (SHA256SUMS + signature), signed apt repo, signed Arch/Flatpak artifacts #288

sky_line referenced this issue from a commit

2026-10-04 08:28:25 +00:00

Linux: signed releases + signed apt repository (#288)

sky_line referenced this issue from a commit

2026-10-04 08:28:25 +00:00

#286: official Flatpak + self-hosted GPG-signed Flatpak repo

sky_line referenced this issue from a commit

2026-10-04 08:28:25 +00:00

#286: slipstream.flatpakref installs beta until a stable release exists

sky_line referenced this issue from a commit

2026-10-04 08:28:25 +00:00

#286: TAGS_REPO instead of git's GIT_DIR; default branch follows stable; doc notes

sky_line commented

2026-10-05 13:33:19 +00:00

Author

Owner

Done: an official Flatpak with a self-hosted, signed Flatpak repo (stable + beta channels) is live (flatpak.slipstreamviewer.org). Flathub submission can be a separate ticket if wanted. Importing from native installs: #416.

sky_line closed this issue

2026-10-05 13:33:19 +00:00

Rows
Columns

Linux: official Flatpak + self-hosted Flatpak repo (then Flathub) for distros without AUR/.deb #286

Build

Sandbox permissions (finish-args), minimal but working

Hosting / distribution

Website / docs

Done when