This repository is a descended from undef1/signal-desktop-builder, credit where it's due.
For directions on installing the flatpak, seek here.
- This repo provides .flatpak binaries as release artifacts here
- This repo provides .deb binaries as release artifacts here
- The upstream repo provides .deb binaries here for some releases.
Brief overview:
- The github action (in .github/workflows/) checks for a new version periodically
- If a new version is found, the script runs and creates a release, builds .deb and .flatpak artifacts, and attaches them to the release
- Internally, the ci-build.py script and flatpak-builder are to produce a deb and bundle it into a flatpak binary
- the flatpak repo dir is pushed to github pages
tl;dr:
SIGNAL_VERSION="$(curl -s https://api.github.com/repos/signalapp/signal-desktop/releases/latest|jq -r '.tag_name')"
SIGNAL_VERSION="${SIGNAL_VERSION#v}"
SIGNAL_BRANCH="${SIGNAL_VERSION%.*}.x"
NODE_VERSION="v$(curl -s https://raw.githubusercontent.com/signalapp/signal-desktop/$SIGNAL_BRANCH/package.json|jq -r '.engines.node')"
python3 ./ci-build.py -a amd64 -n $NODE_VERSION -b $SIGNAL_BRANCH -v $SIGNAL_VERSION
# assumes 'user' flatpak install
flatpak-builder --user --install-deps-from=flathub --repo=.pakrepo --force-clean .builddir flatpak.yml
flatpak build-bundle .pakrepo ./signal.flatpak org.signal.Signal master
flatpak install --user ./signal.flatpak
Flatpak repos are just flat directories and a .flatpakrepo file.
You'll need a GPG key - if it's password protected you'll get asked for the password when building so you can't do that to a key you use in CI. To make one use gpg --gen-key. You don't have to give it your "real" info.
The flatpakrepo file looks like this:
[Flatpak Repo]
Title=Signal Flatpak Repo
Url=https://example.com/flatpak/signal-arm-repo/
GPGKey=<Key Data>
To get the key data, run gpg --armor --export <key email or ID> > key.gpg.
Before you send that key anywhere, inspect key.gpg and make sure it begins and ends with PGP PUBLIC KEY BLOCK and NOT PGP PRIVATE KEY BLOCK. Your private key should be kept private.
If you've made sure it's a public key, run base64 --wrap=0 < key.gpg. This is the key you put in <Key Data>.
For more info see Flatpak.org's documentation on hosting a repo.
Get the Key ID of your secret key. You can get it in the GNOME application "Passwords and Keys" (or seahorse), or gpg --list-keys --keyid-format long.
Look for this line and that's the ID you supply to flatpak-builder.
pub rsa4096/FBEF43DC8C6BE9A7 2022-06-04 [SC]
|-- ^ this ID ---|
Build the Flatpak:
This builds inside of a container image defined here
git clone https://github.com/signalflatpak/signal.git
cd signal
# obtain node version, signal version, and branch:
SIGNAL_VERSION="$(curl -s https://api.github.com/repos/signalapp/signal-desktop/releases/latest|jq -r '.tag_name')"
SIGNAL_VERSION="${SIGNAL_VERSION#v}"
SIGNAL_BRANCH="${SIGNAL_VERSION%.*}.x"
NODE_VERSION="v$(curl -s https://raw.githubusercontent.com/signalapp/signal-desktop/$SIGNAL_BRANCH/package.json|jq -r '.engines.node')"
python3 ci-build.py -a [amd64/arm64] -n $NODE_VERSION -v $SIGNAL_VERSION -b $SIGNAL_BRANCH
mv ~/signal-[arm64/amd64].deb .
flatpak-builder --arch=[x86_64/aarch64] --gpg-sign=FBEF43DC8C6BE9A7 --repo=/opt/pakrepo --force-clean .builddir flatpak.yml
.flatpakrepo and your ./repodir can be served over http.
flatpak build-bundle --arch=[x86_64/aarch64] ./repodir ./signal.flatpak org.signal.Signal master
https://gitlab.com/undef1/Snippets/-/snippets/2100495 https://gitlab.com/ohfp/pinebookpro-things/-/tree/master/signal-desktop Flatpak based on Flathub Sigal Desktop builds
signal-desktop.shhttps://github.com/flathub/org.signal.Signal/blob/master/signal-desktop.shorg.signal.Signal.metainfo.xmlhttps://github.com/flathub/org.signal.Signal/blob/master/org.signal.Signal.metainfo.xmlflatpak.ymlhttps://github.com/flathub/org.signal.Signal/blob/master/org.signal.Signal.yaml
Only insofar as you can trust upstream Signal. There's almost nothing custom going on here. The builds you see in CI produce the artifacts on the release tag and automatically sync to the repo. There's nothing in between the two. You can decide from there.
This only exists because some people wanted Signal to work on the Pinephone, and it would take more work to not make it a public thing. Plus this way I can get help from some awesome contributors.
So no, you can't trust these builds, you can't trust any software or anyone, but I can assure you at least I'm not trying to do anything weird here.
As with most Free Software there is no warranty. We're not responsible if this flatpak deletes your data or releases the magic smoke from your computer.
I'll gladly accept donations but you're of course not obligated. This is a project I use myself and will continue as long as I still use it.
