cryptomator/dist/linux/flatpak/org.cryptomator.Cryptomator.TEMPLATE.yaml

app-id: org.cryptomator.Cryptomator
command: cryptomator
runtime: org.freedesktop.Platform
runtime-version: '25.08'
sdk: org.freedesktop.Sdk
separate-locales: false
finish-args:
  # Required for FUSE, see https://github.com/flathub/org.cryptomator.Cryptomator/pull/68#issuecomment-1935136502
  - --device=all
  # Set the PATH environment variable in the application, as flatpak is resetting the shell's PATH
  - --env=PATH=/app/bin/:/usr/bin/
  # Allow filesystem access to the user's home dir
  # Needed to manage vaults there
  - --filesystem=home
  # Reading system certificates
  - --filesystem=host-etc:ro
  # Allow access to the XDG data directory
  # Needed to connect to KeePassXC's UNIX domain socket
  - --filesystem=xdg-run/org.keepassxc.KeePassXC.BrowserServer
  - --filesystem=xdg-run/app/org.keepassxc.KeePassXC/
  # Share IPC namespace with the host, without it the X11 shared memory extension will not work
  - --share=ipc
  # Allow access to the network
  - --share=network
  # Show windows using X11
  - --socket=x11
  # Needed to reveal encrypted files
  - --talk-name=org.freedesktop.FileManager1
  # Run any command on the host
  # Needed to spawn fusermount on the host
  - --talk-name=org.freedesktop.Flatpak
  # Allow desktop notifications
  - --talk-name=org.freedesktop.Notifications
  # Allow access to the GNOME secret service API and to talk to the GNOME keyring daemon
  - --talk-name=org.freedesktop.secrets
  - --talk-name=org.gnome.keyring
  # Allow to talk to the KDE kwallet daemon
  - --talk-name=org.kde.kwalletd5
  - --talk-name=org.kde.kwalletd6
  # Needed to talk to the gvfs daemons over D-Bus and list mounts using the GIO APIs
  - --talk-name=org.gtk.vfs.*
  # Allow access to appindicator icons
  - --talk-name=org.ayatana
  # Allow access to appindicator icons on KDE
  - --talk-name=org.kde.StatusNotifierWatcher
cleanup:
  - /include
  - /lib/pkgconfig
modules:
  - shared-modules/libayatana-appindicator/libayatana-appindicator-gtk3.json
  - name: libfuse
    buildsystem: meson
    config-opts:
      - -Dexamples=false
      - -Dinitscriptdir=
      - -Duseroot=false
      - -Dtests=false
      # don't install rules on the host
      - -Dudevrulesdir=/tmp/
    sources:
      - type: archive
        url: https://github.com/libfuse/libfuse/releases/download/fuse-3.16.2/fuse-3.16.2.tar.gz
        sha256: f797055d9296b275e981f5f62d4e32e089614fc253d1ef2985851025b8a0ce87
        x-checker-data:
          type: anitya
          project-id: 861
          url-template: https://github.com/libfuse/libfuse/releases/download/fuse-$version/fuse-$version.tar.gz
          versions: {<: '3.17.0'}
  - name: host-command-wrapper
    buildsystem: simple
    build-commands:
      - install fusermount-wrapper.sh /app/bin/fusermount3
    sources:
      - type: file
        path: build-aux/fusermount-wrapper.sh
  - name: cryptomator
    buildsystem: simple
    build-options:
      build-args:
        - --share=network
      env:
        PATH: /app/bin:/usr/bin
        MAVEN_OPTS: -Dmaven.repo.local=.m2/repository
        JAVA_HOME: jdk
        JMODS_PATH: jmods
        VERSION: $FLATPAK_VERSION
        REVISION_NO: '$FLATPAK_REVISION'
    build-commands:
      # Setup Java
      - tar xvfz jdk.tar.gz --transform 's!^[^/]*!jdk!'
      - mkdir jmods
      - unzip -j openjfx.zip \*/javafx.base.jmod \*/javafx.controls.jmod \*/javafx.fxml.jmod \*/javafx.graphics.jmod -d jmods
      # Setup Maven
      - mkdir maven
      - tar xf maven.tar.gz --strip-components=1 --exclude=jansi-native --directory=maven
      # Build project
      - maven/bin/mvn clean package -DskipTests -P"linux-$(uname -m)"
      - cp target/cryptomator-*.jar target/mods
      - cd target
      - $JAVA_HOME/bin/jlink
        --output runtime
        --module-path $JMODS_PATH
        --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported,jdk.security.auth,jdk.accessibility,jdk.management.jfr,jdk.net,java.compiler
        --no-header-files
        --no-man-pages
        --strip-debug
        --compress=zip-0
      - $JAVA_HOME/bin/jpackage
        --type app-image
        --runtime-image runtime
        --input target/libs
        --module-path target/mods
        --module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator
        --dest .
        --name Cryptomator
        --vendor 'Skymatic GmbH'
        --copyright '(C) 2016 - 2026 Skymatic GmbH'
        --java-options '--enable-native-access=javafx.graphics,org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64,org.purejava.appindicator'
        --java-options "--sun-misc-unsafe-memory-access=allow"
        --java-options '-Xss5m'
        --java-options '-Xmx256m'
        --java-options '-Dfile.encoding='utf-8''
        --java-options '-Djava.net.useSystemProxies=true'
        --java-options "-Dcryptomator.appVersion='${VERSION}'"
        --java-options "-Dcryptomator.buildNumber='flatpak-${REVISION_NO}'"
        --java-options '-Dcryptomator.ipcSocketPath='@{userhome}/.config/Cryptomator/ipc.socket''
        --java-options '-Dcryptomator.adminConfigPath='/run/host/etc/cryptomator/config.properties''
        --java-options '-Dcryptomator.logDir='@{userhome}/.local/share/Cryptomator/logs''
        --java-options '-Dcryptomator.mountPointsDir='@{userhome}/.local/share/Cryptomator/mnt''
        --java-options '-Dcryptomator.pluginDir='@{userhome}/.local/share/Cryptomator/plugins''
        --java-options '-Dcryptomator.p12Path='@{userhome}/.config/Cryptomator/key.p12''
        --java-options '-Dcryptomator.settingsPath='@{userhome}/.config/Cryptomator/settings.json:~/.Cryptomator/settings.json''
        --java-options '-Dcryptomator.showTrayIcon=true'
        --java-options '-Dcryptomator.updateMechanism=org.cryptomator.linux.update.FlatpakUpdater'
        --java-options '-Dcryptomator.networking.truststore.p12Path='/run/host/etc/cryptomator/certs.p12''
        --java-options '-Dcryptomator.hub.enableTrustOnFirstUse=true'
        --app-version "${VERSION}.${REVISION_NO}"
        --verbose
      - cp -R Cryptomator /app/
      - ln -s /app/Cryptomator/bin/Cryptomator /app/bin/cryptomator
      - cp -R /app/lib/* /app/Cryptomator/lib/app/
      - install -D -m0644 -t /app/share/applications/ dist/linux/common/org.cryptomator.Cryptomator.desktop
      - install -D -m0644 -t /app/share/icons/hicolor/scalable/apps/ dist/linux/common/org.cryptomator.Cryptomator.svg
      - install -D -m0644 -T dist/linux/common/org.cryptomator.Cryptomator.tray.svg /app/share/icons/hicolor/symbolic/apps/org.cryptomator.Cryptomator.tray-symbolic.svg
      - install -D -m0644 -T dist/linux/common/org.cryptomator.Cryptomator.tray-unlocked.svg /app/share/icons/hicolor/symbolic/apps/org.cryptomator.Cryptomator.tray-unlocked-symbolic.svg
      - install -D -m0644 -t /app/share/metainfo/ dist/linux/common/org.cryptomator.Cryptomator.metainfo.xml
    sources:
      - $CRYPTOMATOR_SOURCE
      - type: file
        dest-filename: jdk.tar.gz
        only-arches:
          - x86_64
        url: https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.2%2B10/OpenJDK25U-jdk_x64_linux_hotspot_25.0.2_10.tar.gz
        sha512: 29043fde119a031c2ca8d57aed445fedd9e7f74608fcdc7a809076ba84cfd1c31f08de2ecccf352e159fdcd1cae172395ed46363007552ff242057826c81ab3a
      - type: file
        dest-filename: jdk.tar.gz
        only-arches:
          - aarch64
        url: https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.2%2B10/OpenJDK25U-jdk_aarch64_linux_hotspot_25.0.2_10.tar.gz
        sha512: f1d3ccec3e1f1bed9d632f14b9223709d6e5c2e0d922125d068870dd3016492a2ca8f08924d4a9d0dc5eb2159fa09efee366a748fd0093475baf29e5c70c781a
      - type: file
        dest-filename: openjfx.zip
        only-arches:
          - x86_64
        url: https://download2.gluonhq.com/openjfx/25.0.2/openjfx-25.0.2_linux-x64_bin-jmods.zip
        sha512: 21f550217101c513f9eb1d7947eba30cb79618238e6539ce770e54e84b01574cdaeba40af602391145f163dd8e43e3794395467413152f13ffffeff948b0ca1b
      - type: file
        dest-filename: openjfx.zip
        only-arches:
          - aarch64
        url: https://download2.gluonhq.com/openjfx/25.0.2/openjfx-25.0.2_linux-aarch64_bin-jmods.zip
        sha512: a9268409b3803e386490bf1319d0f0a14173cebe862c12254cd51b430ee0a297437d9e38d5ebeae0da8899be898b312b103330d09dcfd3e63c1e7d15f2f14311
      - type: file
        dest-filename: maven.tar.gz
        url: https://repo1.maven.org/maven2/org/apache/maven/apache-maven/3.9.13/apache-maven-3.9.13-bin.tar.gz
        sha512: d9ccd44ba2991586e359c29eb86780ae8ff4ec1b88b0b8af3af074803472690cf2017782a9c4401343c62cbcd056231db9612e1e551cbd9747c21746d732c015
        x-checker-data:
          type: anitya
          project-id: 1894
          stable-only: true
          url-template: https://repo1.maven.org/maven2/org/apache/maven/apache-maven/$version/apache-maven-$version-bin.tar.gz
          versions: {<: '4.0'}