Skip to content
Snippets Groups Projects
Commit a8991da4 authored by Arnaud Ferraris's avatar Arnaud Ferraris Committed by Emanuele Aina
Browse files

Address review comments


This commit includes suggestions from reviewers and fixes the following
issues:
* use `ref` macros for internal links
* fix minor grammar and spelling issues
* add a warning regarding the preliminary state of Ed25519 support

Signed-off-by: default avatarArnaud Ferraris <arnaud.ferraris@collabora.com>
parent dc6fcabb
No related branches found
No related tags found
1 merge request!197guides: Add flatpak signature guide
......@@ -6,12 +6,19 @@ title = "Application verification using Flatpak"
+++
Starting with Apertis v2022dev2, [Flatpak](https://flatpak.org) includes the
ability to distribute [application bundles](/glossary/#application-bundle)
ability to distribute [application bundles]( {{< ref "glossary.md#application-bundle" >}} )
verified with [ed25519](https://ed25519.cr.yp.to/) signatures.
This signature system rely on ostree's library functions. Therefore, the key
{{% notice warning %}}
The current implementation is a technology preview and it is expected to stabilize
during the release cycles leading to the v2022 stable release. The prototype is
already available in Apertis as documented here, but it may be subject to potentially
incompatible changes during the [upstream review process](https://github.com/flatpak/flatpak/pull/4170).
{{% /notice %}}
This signature system relies on OSTree's library functions. Therefore, the key
generation and storage process is identical to what is described in the
[System updates and rollback](/designs/system-updates-and-rollback/#verified-updates)
[System updates and rollback]( {{< ref "system-updates-and-rollback.md#verified-updates" >}} )
design document.
Flatpak application signatures occur on several levels:
......@@ -27,7 +34,7 @@ verified. Similarly, it is not possible to sign flatpak applications using GPG.
The simplest way to create a signed flatpak is to use `flatpak-builder` with
the `--sign=<SECRETKEY>` command-line argument, where `<SECRETKEY>` is the
base64-encoded secret Ed25519 key. This ensures the ostree commit and summary
base64-encoded secret Ed25519 key. This ensures the OSTree commit and summary
are properly signed.
For more advanced usage, the same command-line option can also be used with the
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment