rufpak

rufpak turns a Flatpak application into a native Arch package. The packaged application does not need Flatpak or its runtime at run time. Building the generated package requires the ostree-dlagent package installed.

Install

pip install rufpak

Or run it without installing, via uv:

uvx rufpak com.github.PintaProject.Pinta --gpg-key publisher-key.asc ...

Build a package

rufpak can download signed OSTree content without Flatpak. Get the application publisher's public OSTree signing key.

rufpak com.github.PintaProject.Pinta \
    --repourl https://dl.flathub.org/repo/ \
    --gpg-key publisher-key.asc \
    --probe 30 \
    --outdir build
cd build
makepkg -si

The default runtime remote is the application remote. Set the runtime remote and key when the application uses a different runtime.

rufpak com.kagi.Orion \
    --repourl https://flatpak.orionbrowser.com/repo/beta/ \
    --gpg-key orion-key.asc \
    --runtime-repourl https://dl.flathub.org/repo/ \
    --runtime-gpg-key flathub-key.asc \
    --outdir build

--gpg-key is required. The generated PKGBUILD pins the key's fingerprint in validpgpkeys and ships the key itself under keys/pgp/, so makepkg verifies the application source during the build — using your own GPG keyring, not rufpak's. Import the key first (gpg --import keys/pgp/*.asc in the output directory) or the build will fail with "PGP key could not be verified". --allow-unverified disables this and is unsafe.

Configuration

Pass a JSON object with --config rufpak.json. rufpak does not search for or load configuration files automatically. JSON keys use long option names with underscores. CLI values override config values.

{
  "appid": "com.github.PintaProject.Pinta",
  "repourl": "https://dl.flathub.org/repo/",
  "gpg_key": "flathub-key.asc",
  "probe": 30
}

How it works

Flatpak applications expect their files at /app. rufpak installs the payload at /opt/rufpak/<appid>. The generated launcher uses bubblewrap to mount that directory at /app.

The generated PKGBUILD fetches the app and, if needed, its runtime through ostree-dlagent, a makepkg DLAGENTS handler that turns a pinned OSTree commit into three sources instead of a hand-rolled ostree pull in prepare(): the commit object (sha256sums-pinned to the commit itself), its detached GPG signature (checked by makepkg against validpgpkeys, using your keyring), and the content as a tar. This also gets normal makepkg source caching for free.

Dependencies

rufpak scans application ELF files for DT_NEEDED libraries. It also scans for library names used with dlopen, P/Invoke, or ctypes. Host libraries are converted to Arch package dependencies.

--probe SECONDS starts the application and reads its loaded libraries. Use it for applications with dynamic runtimes such as .NET. The probe needs a working display. Review its output because drivers and desktop services from the build machine can appear as optional dependencies.

Libraries that Arch does not provide at the required ABI are copied from the Flatpak runtime into the package payload.

Files and desktop integration

The launcher uses the Flatpak [Context] declaration for user directories. --no-confine exposes the whole home directory and should only be used when the application needs it.

--xdg app is the default. It stores XDG configuration, data, and cache under ~/.var/app/<appid>. --xdg host uses the host desktop XDG directories. This applies host GTK styles, which can break libadwaita applications.

Security limits

The launcher is not a replacement for Flatpak. It has no Flatpak seccomp filter or D-Bus proxy. An application can access the real session bus. Do not use rufpak to run an application you do not trust.

Generated files

rufpak writes a PKGBUILD and a bubblewrap launcher to the output directory. The package installs application files under /opt/rufpak/<appid>. The launcher is installed under /usr/bin.