Metadata-Version: 2.4
Name: rufpak
Version: 1.0.0
Summary: Turn an installed Flatpak app into a native Arch package
Author-email: Nemo <pypi@captnemo.in>
License-Expression: Unlicense
License-File: LICENSE
Keywords: archlinux,bubblewrap,flatpak,ostree,pacman,pkgbuild
Classifier: Environment :: Console
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: System :: Archiving :: Packaging
Classifier: Topic :: System :: Installation/Setup
Requires-Python: >=3.9
Description-Content-Type: text/markdown

# rufpak

rufpak turns a Flatpak application into a native Arch package.
The packaged application does not need Flatpak or its runtime at run time.
Building the generated package requires the `ostree-dlagent` package installed.

## Install

    pip install rufpak

Or run it without installing, via [uv](https://docs.astral.sh/uv/):

    uvx rufpak com.github.PintaProject.Pinta --gpg-key publisher-key.asc ...

## Build a package

rufpak can download signed OSTree content without Flatpak.
Get the application publisher's public OSTree signing key.

    rufpak com.github.PintaProject.Pinta \
        --repourl https://dl.flathub.org/repo/ \
        --gpg-key publisher-key.asc \
        --probe 30 \
        --outdir build
    cd build
    makepkg -si

The default runtime remote is the application remote.
Set the runtime remote and key when the application uses a different runtime.

    rufpak com.kagi.Orion \
        --repourl https://flatpak.orionbrowser.com/repo/beta/ \
        --gpg-key orion-key.asc \
        --runtime-repourl https://dl.flathub.org/repo/ \
        --runtime-gpg-key flathub-key.asc \
        --outdir build

`--gpg-key` is required.
The generated PKGBUILD pins the key's fingerprint in `validpgpkeys` and
ships the key itself under `keys/pgp/`, so `makepkg` verifies the
application source during the build — using your own GPG keyring, not
rufpak's. Import the key first (`gpg --import keys/pgp/*.asc` in the
output directory) or the build will fail with "PGP key could not be
verified". `--allow-unverified` disables this and is unsafe.

## Configuration

Pass a JSON object with `--config rufpak.json`.
rufpak does not search for or load configuration files automatically.
JSON keys use long option names with underscores.
CLI values override config values.

    {
      "appid": "com.github.PintaProject.Pinta",
      "repourl": "https://dl.flathub.org/repo/",
      "gpg_key": "flathub-key.asc",
      "probe": 30
    }

## How it works

Flatpak applications expect their files at `/app`.
rufpak installs the payload at `/opt/rufpak/<appid>`.
The generated launcher uses bubblewrap to mount that directory at `/app`.

The generated PKGBUILD fetches the app and, if needed, its runtime through
`ostree-dlagent`, a `makepkg` DLAGENTS handler that turns a pinned OSTree
commit into three sources instead of a hand-rolled `ostree pull` in
`prepare()`: the commit object (`sha256sums`-pinned to the commit itself),
its detached GPG signature (checked by `makepkg` against `validpgpkeys`,
using your keyring), and the content as a tar. This also gets normal
`makepkg` source caching for free.

## Dependencies

rufpak scans application ELF files for `DT_NEEDED` libraries.
It also scans for library names used with `dlopen`, P/Invoke, or ctypes.
Host libraries are converted to Arch package dependencies.

`--probe SECONDS` starts the application and reads its loaded libraries.
Use it for applications with dynamic runtimes such as .NET.
The probe needs a working display.
Review its output because drivers and desktop services from the build machine
can appear as optional dependencies.

Libraries that Arch does not provide at the required ABI are copied from the
Flatpak runtime into the package payload.

## Files and desktop integration

The launcher uses the Flatpak `[Context]` declaration for user directories.
`--no-confine` exposes the whole home directory and should only be used when
the application needs it.

`--xdg app` is the default.
It stores XDG configuration, data, and cache under `~/.var/app/<appid>`.
`--xdg host` uses the host desktop XDG directories.
This applies host GTK styles, which can break libadwaita applications.

## Security limits

The launcher is not a replacement for Flatpak.
It has no Flatpak seccomp filter or D-Bus proxy.
An application can access the real session bus.
Do not use rufpak to run an application you do not trust.

## Generated files

rufpak writes a `PKGBUILD` and a bubblewrap launcher to the output directory.
The package installs application files under `/opt/rufpak/<appid>`.
The launcher is installed under `/usr/bin`.
