Skip to content
Snippets Groups Projects

guides: Add flatpak signature guide

Merged Arnaud Ferraris requested to merge wip/aferraris/flatpak-signatures into master
All threads resolved!
1 file
+ 11
4
Compare changes
  • Side-by-side
  • Inline
+ 11
4
@@ -6,12 +6,19 @@ title = "Application verification using Flatpak"
+++
Starting with Apertis v2022dev2, [Flatpak](https://flatpak.org) includes the
ability to distribute [application bundles](/glossary/#application-bundle)
ability to distribute [application bundles]( {{< ref "glossary.md#application-bundle" >}} )
verified with [ed25519](https://ed25519.cr.yp.to/) signatures.
This signature system rely on ostree's library functions. Therefore, the key
{{% notice warning %}}
The current implementation is a technology preview and it is expected to stabilize
during the release cycles leading to the v2022 stable release. The prototype is
already available in Apertis as documented here, but it may be subject to potentially
incompatible changes during the [upstream review process](https://github.com/flatpak/flatpak/pull/4170).
{{% /notice %}}
This signature system relies on OSTree's library functions. Therefore, the key
generation and storage process is identical to what is described in the
[System updates and rollback](/designs/system-updates-and-rollback/#verified-updates)
[System updates and rollback]( {{< ref "system-updates-and-rollback.md#verified-updates" >}} )
design document.
Flatpak application signatures occur on several levels:
@@ -27,7 +34,7 @@ verified. Similarly, it is not possible to sign flatpak applications using GPG.
The simplest way to create a signed flatpak is to use `flatpak-builder` with
the `--sign=<SECRETKEY>` command-line argument, where `<SECRETKEY>` is the
base64-encoded secret Ed25519 key. This ensures the ostree commit and summary
base64-encoded secret Ed25519 key. This ensures the OSTree commit and summary
are properly signed.
For more advanced usage, the same command-line option can also be used with the
Loading