README.md
# thepeoples.io Flatpak catalog
Public packaging recipes for redistributed Flatpaks published to
`https://flatpak.thepeoples.io`. This is **not** a vendor-official Flatpak
and not a Flathub upload.
Default install is `flatpak --user`. `--system` is optional for managed hosts.
Hardware-wallet udev is a helper shipped inside the Sparrow Flatpak
(`files/bin/sparrow-udev`). After install:
```sh
sudo ~/.local/share/flatpak/app/io.thepeoples.Sparrow/current/active/files/bin/sparrow-udev
```
Source of the first Sparrow wrap: the signed **Linux tarball** plus Craig Raw’s
GPG manifest. The distrobox RPM path stays in the private sandbox.
## Build and publish
Host runner label `desktop-flatpak` (VM103) runs
`.gitea/workflows/build-flatpak-remote.yml` on `workflow_dispatch` only.
That job verifies vendor pins, builds admitted apps with `flatpak-builder`,
GPG-signs the ostree summary, uploads the ostree payload plus SPDX, then
POSTs `workflow_dispatch` to `platform/thepeoples.io`
`publish-flatpak-remote.yml` with `run_id` and `artifact_name` only. This
repo does not `uses:` private platform workflows.
```sh
scripts/e2e-catalog.sh
scripts/e2e-published-remote.sh --contracts
scripts/build-flatpak-remote.sh --verify-only
# on the host runner (needs AppRole + flatpak-builder):
scripts/build-flatpak-remote.sh
# on desktop-agent-01 (label desktop-flatpak): install, smoke, cleanup
# published apps into an isolated FLATPAK_USER_DIR, then delete it.
scripts/e2e-published-remote.sh
```
`.gitea/workflows/e2e-published-remote.yml` is `workflow_dispatch` on
`desktop-flatpak`. It adds remote `thepeoples-e2e` (not the everyday
`thepeoples` remote), installs each `ostree_live` app that is not
launch-gated, runs `flatpak --user run --command=true`, uninstalls, and
removes the isolated directory on exit. Proton stays skipped until it
is on the remote.
Default install is still `flatpak --user` from
`https://flatpak.thepeoples.io/thepeoples.flatpakrepo` after the first
publish. `--system` is optional.
Admitted apps: Sparrow (signed tarball) and Proton Mail (official RPM +
zypak). To add another app in the same published shape (artwork,
screenshots, optional helper, pins, Trivy report):
```sh
scripts/new-app.sh --app-id io.thepeoples.Name --slug name --kind rpm
scripts/check-app.sh --app-id io.thepeoples.Name --scaffold-ok
# then docs/submit-app.md
```
Vendor SHA-512 for Proton is re-checked against
`https://proton.me/download/mail/linux/version.json` after download.
```sh
scripts/check-vendor-updates.sh
```
A newer official release is not eligible until 24 hours after the vendor
release timestamp. The daily workflow then **applies** the bump, commits,
and rebuilds the signed remote; apex regenerates from the catalog peer.
See `docs/vendor-updates.md`. Next wraps: `docs/roadmap.md`.
## Generic non-Electron RPM
`templates/rpm/` is the shared extract/pin/SBOM recipe for vendor RPMs that
are **not** Electron/zypak. Proton stays on a separate path. Extract is
`rpm2cpio | cpio` only — never `rpm -i`, never `%post`.
See design 0008 in `platform/thepeoples.io`.