What changed, and why it matters
This commit adds a new automated build step that produces a Flatpak installer for Linux. It does not change the wallet's code, cryptographic handling, or permissions beyond what a normal Linux desktop app needs. There is no indication this is a security fix or introduces a vulnerability.
No security action required. As with any new packaging pipeline, ensure the Flatpak manifest permissions are reviewed periodically and that the CI runner's Flatpak SDK cache and artifact downloads come from trusted sources.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change extends the GitHub Actions CI workflow with a build-flatpak job that downloads the existing Linux x86_64 tarball, stages it with Flatpak metadata files, builds a Flatpak bundle using org.freedesktop.Platform/Sdk 24.08, and uploads the resulting .flatpak artifact. It also adds standard Flatpak packaging files: a .desktop launcher, AppStream metainfo.xml, a Flatpak manifest YAML with typical desktop permissions (network, IPC, X11/Wayland, DRI, secrets/notification D-Bus names), and a wrapper shell script. The release job is updated to include the Flatpak artifact. No application source code is modified.
Changed components
.github/workflows/build.yamlflatpak/com.cypherstack.stackwallet.desktopflatpak/com.cypherstack.stackwallet.metainfo.xmlflatpak/com.cypherstack.stackwallet.yamlflatpak/stack_wallet.shInspect captured patch +129 / −2
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index e9dd3ed..6a92ed6 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -484,9 +484,75 @@ jobs:
name: stack_wallet-ios-aarch64-${{ steps.ver.outputs.version }}
path: stack_wallet-ios-aarch64-${{ steps.ver.outputs.version }}.ipa
+ build-flatpak:
+ runs-on: ubuntu-24.04
+ needs: build-linux
+ steps:
+ - uses: actions/checkout@v6
+
+ - name: Set version
+ id: ver
+ run: |
+ if [ "${{ github.ref_type }}" = "tag" ]; then
+ VERSION="${{ github.ref_name }}"
+ VERSION="${VERSION#v}"
+ elif [ -n "${{ inputs.version }}" ]; then
+ VERSION="${{ inputs.version }}"
+ else
+ VERSION="0.0.0-staging.${{ github.run_number }}"
+ fi
+ echo "version=${VERSION}" >> $GITHUB_OUTPUT
+
+ - name: Download Linux bundle
+ uses: actions/download-artifact@v4
+ with:
+ name: stack_wallet-linux-x86_64-${{ steps.ver.outputs.version }}
+
+ - name: Stage bundle and icon
+ run: |
+ tar -xzf "stack_wallet-linux-x86_64-${{ steps.ver.outputs.version }}.tar.gz" -C flatpak/
+ cp asset_sources/icon/stack_wallet/icon.png flatpak/com.cypherstack.stackwallet.png
+
+ - name: Install Flatpak tools
+ run: |
+ sudo apt-get update -q
+ sudo apt-get install -y flatpak flatpak-builder
+
+ - name: Set up Flathub remote
+ run: flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+
+ - name: Cache Flatpak SDK
+ uses: actions/cache@v4
+ with:
+ path: ~/.local/share/flatpak
+ key: flatpak-freedesktop-24.08-v1
+
+ - name: Install Flatpak SDK
+ run: |
+ flatpak install --user --noninteractive flathub \
+ org.freedesktop.Platform//24.08 \
+ org.freedesktop.Sdk//24.08
+
+ - name: Build Flatpak
+ run: |
+ flatpak-builder --user --force-clean \
+ --repo=flatpak-repo \
+ build-flatpak flatpak/com.cypherstack.stackwallet.yaml
+
+ - name: Bundle Flatpak
+ run: |
+ flatpak build-bundle flatpak-repo \
+ "stack_wallet-linux-x86_64-${{ steps.ver.outputs.version }}.flatpak" \
+ com.cypherstack.stackwallet
+
+ - uses: actions/upload-artifact@v4
+ with:
+ name: stack_wallet-flatpak-x86_64-${{ steps.ver.outputs.version }}
+ path: stack_wallet-linux-x86_64-${{ steps.ver.outputs.version }}.flatpak
+
release:
if: github.ref_type == 'tag'
- needs: [build-linux, build-android, build-windows, build-macos, build-ios]
+ needs: [build-linux, build-android, build-windows, build-macos, build-ios, build-flatpak]
runs-on: ubuntu-latest
permissions:
contents: write
@@ -503,7 +569,7 @@ jobs:
name=$(basename "$dir")
(cd "$dir" && zip -r "../../release-files/${name}.zip" .)
done
- find artifacts/ \( -name "*.tar.gz" -o -name "*.zip" -o -name "*.ipa" \) -mindepth 2 -exec mv {} release-files/ \;
+ find artifacts/ \( -name "*.tar.gz" -o -name "*.zip" -o -name "*.ipa" -o -name "*.flatpak" \) -mindepth 2 -exec mv {} release-files/ \;
find artifacts/ -name "*.apk" -mindepth 2 -exec mv {} release-files/ \;
- uses: softprops/action-gh-release@v2
diff --git a/flatpak/com.cypherstack.stackwallet.desktop b/flatpak/com.cypherstack.stackwallet.desktop
new file mode 100644
index 0000000..d5b7d55
--- /dev/null
+++ b/flatpak/com.cypherstack.stackwallet.desktop
@@ -0,0 +1,7 @@
+[Desktop Entry]
+Name=Stack Wallet
+Comment=Open-source non-custodial cryptocurrency wallet
+Exec=stack_wallet
+Icon=com.cypherstack.stackwallet
+Type=Application
+Categories=Finance;
diff --git a/flatpak/com.cypherstack.stackwallet.metainfo.xml b/flatpak/com.cypherstack.stackwallet.metainfo.xml
new file mode 100644
index 0000000..abf3b19
--- /dev/null
+++ b/flatpak/com.cypherstack.stackwallet.metainfo.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<component type="desktop-application">
+ <id>com.cypherstack.stackwallet</id>
+ <metadata_license>CC0-1.0</metadata_license>
+ <project_license>GPL-3.0-only</project_license>
+ <name>Stack Wallet</name>
+ <summary>Open-source non-custodial cryptocurrency wallet</summary>
+ <description>
+ <p>
+ Stack Wallet is an open-source, non-custodial, privacy-focused
+ cryptocurrency wallet supporting multiple coins.
+ </p>
+ </description>
+ <url type="homepage">https://stackwallet.com</url>
+ <url type="bugtracker">https://github.com/cypherstack/stack_wallet/issues</url>
+ <content_rating type="oars-1.1"/>
+</component>
diff --git a/flatpak/com.cypherstack.stackwallet.yaml b/flatpak/com.cypherstack.stackwallet.yaml
new file mode 100644
index 0000000..3707ccb
--- /dev/null
+++ b/flatpak/com.cypherstack.stackwallet.yaml
@@ -0,0 +1,35 @@
+app-id: com.cypherstack.stackwallet
+runtime: org.freedesktop.Platform
+runtime-version: '24.08'
+sdk: org.freedesktop.Sdk
+command: stack_wallet
+
+finish-args:
+ - --share=network
+ - --share=ipc
+ - --socket=fallback-x11
+ - --socket=wayland
+ - --device=dri
+ - --talk-name=org.freedesktop.secrets
+ - --talk-name=org.freedesktop.Notifications
+
+modules:
+ - name: stack_wallet
+ buildsystem: simple
+ build-commands:
+ # Install the pre-built Flutter bundle under /app/lib/stack_wallet/ so
+ # the binary's $ORIGIN/lib and $ORIGIN/data lookups resolve correctly.
+ - mkdir -p /app/lib/stack_wallet
+ - install -Dm755 bundle/stack_wallet /app/lib/stack_wallet/stack_wallet
+ - cp -r bundle/lib bundle/data /app/lib/stack_wallet/
+ # Wrapper script so the Flatpak command path resolves to the binary.
+ - install -Dm755 stack_wallet.sh /app/bin/stack_wallet
+ - install -Dm644 com.cypherstack.stackwallet.desktop
+ /app/share/applications/com.cypherstack.stackwallet.desktop
+ - install -Dm644 com.cypherstack.stackwallet.metainfo.xml
+ /app/share/metainfo/com.cypherstack.stackwallet.metainfo.xml
+ - install -Dm644 com.cypherstack.stackwallet.png
+ /app/share/icons/hicolor/512x512/apps/com.cypherstack.stackwallet.png
+ sources:
+ - type: dir
+ path: .
diff --git a/flatpak/stack_wallet.sh b/flatpak/stack_wallet.sh
new file mode 100644
index 0000000..db2f325
--- /dev/null
+++ b/flatpak/stack_wallet.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec /app/lib/stack_wallet/stack_wallet "$@"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.