diff --git a/content/guides/flatpak.md b/content/guides/flatpak.md index 5dbb97137a4827fb047a59f5a3283a335bf026e3..a1aa3294caf98d1a9450c20347582ebd3064f2ec 100644 --- a/content/guides/flatpak.md +++ b/content/guides/flatpak.md @@ -6,12 +6,19 @@ title = "Application verification using Flatpak" +++ Starting with Apertis v2022dev2, [Flatpak](https://flatpak.org) includes the -ability to distribute [application bundles](/glossary/#application-bundle) +ability to distribute [application bundles]( {{< ref "glossary.md#application-bundle" >}} ) verified with [ed25519](https://ed25519.cr.yp.to/) signatures. -This signature system rely on ostree's library functions. Therefore, the key +{{% notice warning %}} +The current implementation is a technology preview and it is expected to stabilize +during the release cycles leading to the v2022 stable release. The prototype is +already available in Apertis as documented here, but it may be subject to potentially +incompatible changes during the [upstream review process](https://github.com/flatpak/flatpak/pull/4170). +{{% /notice %}} + +This signature system relies on OSTree's library functions. Therefore, the key generation and storage process is identical to what is described in the -[System updates and rollback](/designs/system-updates-and-rollback/#verified-updates) +[System updates and rollback]( {{< ref "system-updates-and-rollback.md#verified-updates" >}} ) design document. Flatpak application signatures occur on several levels: @@ -27,7 +34,7 @@ verified. Similarly, it is not possible to sign flatpak applications using GPG. The simplest way to create a signed flatpak is to use `flatpak-builder` with the `--sign=<SECRETKEY>` command-line argument, where `<SECRETKEY>` is the -base64-encoded secret Ed25519 key. This ensures the ostree commit and summary +base64-encoded secret Ed25519 key. This ensures the OSTree commit and summary are properly signed. For more advanced usage, the same command-line option can also be used with the