FLATPAK-MANIFEST(5)

📦

version 1.4.12 · 16 versions

1.4.12 · alpine 3.24, arch rolling, ubuntu stonking (latest)
1.4.4 · opensuse-leap 16.0
1.4.4 · nixos 26.05
1.2.3 · centos-stream 9
1.4.7 · centos-stream 10
1.4.10 · nixpkgs unstable
1.4.6 · ubuntu questing
1.4.12 · fedora 43
1.4.4 · fedora 43
1.2.2 · ubuntu jammy
1.4.12 · fedora 44
1.4.7 · fedora 44
1.2.3 · debian bookworm
1.4.2 · ubuntu noble
1.4.8 · ubuntu resolute
1.4.4 · debian trixie

, in alpine 3.24, arch rolling, ubuntu stonking

💅 FLATPAK-MANIFEST ✨

okay so bestie, welcome to flatpak-manifest — this is section 5 of the flatpak manual, and it's literally the blueprint page. buckle up 🎀

🌸 NAME 🌸

flatpak-manifest — all the info you need for building an application 👑

🦋 DESCRIPTION 🦋

Flatpak uses manifest files — you might also hear them called recipe files, same thing, no cap — written in json or yaml format. These lil guys describe how an application and its bundled dependencies get built from sources. And who actually eats the manifest? flatpak-builder. that's the one. 💖

🧚 FILE FORMAT 🧚

The top level of the manifest file is where the tea gets spilled: it describes the global attributes of the application, how it can be built, and the list of modules that need to be built. periodt. ✨

🎀 Toplevel properties 🎀

these are the properties that get accepted, bestie:

id or app-id (string) — a string defining the application id. heads up tho: app-id is deprecated and only preserved for backwards compatibility 🙈 (so like, use it if you must, but know it's giving legacy).
branch (string) — the branch to use when exporting the application. If this is unset, the default comes from the default-branch option. ⚠️ This key overrides both the default-branch key and the --default-branch commandline option. Unless you need a very specific branchname (like for a runtime or an extension), it is recommended to use the default-branch key instead, because that one can be overridden by the --default-branch option. 💅
default-branch (string) — the default branch to use when exporting the application. Defaults to master. This key can be overridden by the --default-branch commandline option. 👑
collection-id (string) — the collection ID of the repository, defaults to being unset. Setting a globally unique collection ID allows the apps in the repository to be shared over peer-to-peer systems without needing further configuration. 🌈 If you're building in an existing repository, the collection ID must match the existing configured collection ID for that repository. (no improvising, bestie.)
extension-tag (string) — if you're building an extension, this is the tag for the extension point to use. Since flatpak 0.11.4 a runtime may define multiple locations for the same extension point, with the intention that different branches for the extension are mounted at each location. When building an extension it is necessary to know what extension point to install the extension to, and this option resolves any ambiguity in which extension point to choose. If not specified, the default choice is to install into either the only location for the extension point or into the location for the untagged extension point. 🫶 If there are multiple locations for the same extension point defined with different tags, then an error will occur — yes, an actual error, she's dramatic like that. 💀
token-type (integer) — the type of token needed to install this commit. Setting this to a value greater than 0 implies that authentication will be needed to install the flatpak. 🔐
runtime (string) — the name of the runtime that the application uses.
runtime-version (string) — the version of the runtime that the application uses, defaults to master.
sdk (string) — the name of the development runtime that the application builds with.
var (string) — initialize the (otherwise empty) writable /var in the build with a copy of this runtime.
metadata (string) — use this file as the base metadata file when finishing.
command (string) — the filename or path to the main binary of the application. ⚠️ Note that this must be a single executable, not a commandline or an absolute path. If you want to pass arguments, install a shell script wrapper and use that as the command. Also note that the command is used when the application is run via flatpak run, and it does not affect what gets executed when the application is run in other ways, e.g. via the desktop file or D-Bus activation. 🙈
build-runtime (boolean) — build a new runtime instead of an application. ✨
build-extension (boolean) — build an extension. 🎀
separate-locales (boolean) — separate out locale files and translations to an extension runtime. Defaults to true.
id-platform (string) — when building a runtime sdk, also create a platform based on it with this id.
metadata-platform (string) — the metadata file to use for the platform we create.
writable-sdk (boolean) — if true, use a writable copy of the sdk for /usr. Defaults to true if build-runtime is specified.
appstream-compose (boolean) — run appstreamcli compose during cleanup phase. Defaults to true.
sdk-extensions (array of strings) — install these extra sdk extensions in /usr.
platform-extensions (array of strings) — install these extra sdk extensions when creating the platform.
base (string) — start with the files from the specified application. This can be used to create applications that extend another application. 🧬
base-version (string) — use this specific version of the application specified in base. If unspecified, this uses the value specified in branch.
base-extensions (array of strings) — install these extra extensions from the base application when initializing the application directory.
inherit-extensions (array of strings) — inherit these extra extension points from the base application or sdk when finishing the build.
inherit-sdk-extensions (array of strings) — inherit these extra extension points from the base application or sdk when finishing the build, but do not inherit them into the platform. 👀
tags (array of strings) — add these tags to the metadata file.
build-options (object) — object specifying the build environment. See below for details 👇
modules (array of objects or strings) — an array of objects specifying the modules to be built in order. String members in the array are interpreted as the name of a separate json or yaml file that contains a module. See below for details 👇
add-extensions (objects) — this is a dictionary of extension objects. The key is the name of the extension. See below for details 👇
add-build-extensions (objects) — this is a dictionary of extension objects similar to add-extensions. The main difference is that the extensions are added early and are available for use during the build. ⏰
cleanup (array of strings) — an array of file patterns that should be removed at the end. Patterns starting with / are taken to be full pathnames (without the /app prefix), otherwise they just match the basename. 🧹
cleanup-commands (array of strings) — an array of commandlines that are run during the cleanup phase.
cleanup-platform (array of strings) — extra files to clean up in the platform.
cleanup-platform-commands (array of strings) — an array of commandlines that are run during the cleanup phase of the platform.
prepare-platform-commands (array of strings) — an array of commandlines that are run after importing the base platform, but before applying the new files from the sdk. This is a good place to e.g. delete things from the base that may conflict with the files added in the sdk. 🫧
finish-args (array of strings) — an array of arguments passed to the flatpak build-finish command.
rename-desktop-file (string) — any desktop file with this name will be renamed to a name based on id during the cleanup phase. The appdata file launchable will be updated if needed.
rename-appdata-file (string) — any appdata (metainfo) file with this name will be renamed to a name based on id during the cleanup phase. The id in the file will be updated as needed and the subsequent provides. (since 1.4.1)
rename-mime-file (string) — any mimetypes file with this name will be renamed to a name based on id during the cleanup phase. (since 1.4.0)
rename-icon (string) — any icon with this name will be renamed to a name based on id during the cleanup phase. Note that this is the icon name, not the full filename, so it should not include a filename extension. 🖼️
rename-mime-icons (array of string) — any mime icons with any of these names will be renamed to a name prefixed with id during the cleanup phase. Note that these are the icon names, not the full filenames, so they should not include a filename extension. (since 1.4.0)
appdata-license (string) — replace the appdata (metainfo) project_license field with this string. This is useful as the upstream license is typically only about the application itself, whereas the bundled app can contain other licenses too. 📜
copy-icon (boolean) — if rename-icon is set, keep a copy of the old icon file.
desktop-file-name-prefix (string) — this string will be prefixed to the Name key in the main application desktop file.
desktop-file-name-suffix (string) — this string will be suffixed to the Name key in the main application desktop file.

⭐ Build Options ⭐

Build options specify the build environment of a module, and can be specified globally as well as per-module. ✨ Options can also be specified on a per-architecture basis using the arch property. iykyk.

these are the properties that get accepted:

cflags (string) — this is set in the environment variable CFLAGS during the build. Multiple specifications of this (in e.g. per-arch area) are concatenated, separated by spaces.
cflags-override (boolean) — if this is true, clear cflags from previous build options before adding it from these options.
cppflags (string) — this is set in the environment variable CPPFLAGS during the build. Multiple specifications of this (in e.g. per-arch area) are concatenated, separated by spaces.
cppflags-override (boolean) — if this is true, clear cppflags from previous build options before adding it from these options.
cxxflags (string) — this is set in the environment variable CXXFLAGS during the build. Multiple specifications of this (in e.g. per-arch area) are concatenated, separated by spaces.
cxxflags-override (boolean) — if this is true, clear cxxflags from previous build options before adding it from these options.
ldflags (string) — this is set in the environment variable LDFLAGS during the build. Multiple specifications of this (in e.g. per-arch area) are concatenated, separated by spaces.
ldflags-override (boolean) — if this is true, clear ldflags from previous build options before adding it from these options.
prefix (string) — the build prefix for the modules (defaults to /app for applications and /usr for runtimes).
libdir (string) — the build libdir for the modules (defaults to /app/lib for applications and /usr/lib for runtimes).
append-path (string) — this gets tacked onto the end of PATH in the build env, with a leading colon if it needs one. ✨
prepend-path (string) — this goes at the front of PATH in the build env, with a trailing colon if needed. 💅
append-ld-library-path (string) — appended to LD_LIBRARY_PATH in the build environment (leading colon if needed). 🦋
prepend-ld-library-path (string) — prepended to LD_LIBRARY_PATH in the build environment (trailing colon if needed). 🦋
append-pkg-config-path (string) — appended to PKG_CONFIG_PATH in the build environment (leading colon if needed). 🎀
prepend-pkg-config-path (string) — prepended to PKG_CONFIG_PATH in the build environment (trailing colon if needed). 🎀
env (object) — bestie it's literally just a dictionary of environment variables to set during the build 🫶. Anything in here overrides the properties that set the environment, like cflags and ldflags. And if a key has a null value? That unsets the variable. Iconic.
secret-env (array of strings) — an array saying which host environment variables get transferred into the build-commands or post-install environment. 🤫
build-args (array of strings) — extra options to hand to flatpak build. 🔥
test-args (array of strings) — same energy as build-args but it hits the tests, not the normal build. 😌
config-opts (array of strings) — extra options passed to the build system during configuration.
secret-opts (array of strings) — options passed to configure, specifically for sneaking secrets through host environment variables 👀. Environment variables inside the options get expanded. Like:

'-DSECRET_ID=$CI_SECRET'

make-args (array of strings) — extra arguments passed to make.
make-install-args (array of strings) — extra arguments passed to make install.
strip (boolean) — if true, every ELF file gets stripped after install. Default is false, no cap. 💀
no-debuginfo (boolean) — so by default (when strip isn't true) flatpak-builder pulls all the debug info out of ELF files into separate files and drops them into an extension. Wanna kill that? Set no-debuginfo to true.
no-debuginfo-compression (boolean) — when it extracts debuginfo, the debug sections get compressed. To turn that off, set no-debuginfo-compression to true.
arch (object) — a dictionary that defines a whole separate build options object per arch, to override the main build options. 🌈

🧩 Extension ✨

This defines extension points in the app or runtime that extensions can implement, supplying extra files that are available during runtime. So useful fr fr.

Here's what it accepts:

directory (string) — where the extension gets mounted 📁. If the extension point is for an application, this path is relative to /app; otherwise it's relative to /usr.
bundle (boolean) — if true, the data created in the extension directory gets left out of the result and instead gets packaged into its own separate extension. 🎁
remove-after-build (boolean) — if true, the extension gets removed once finishing up. This is only interesting for extensions in the add-build-extensions property.

And also — the standard flatpak extension properties are supported, and get dropped directly into the metadata file: autodelete, no-autodownload, subdirectories, add-ld-path, download-if, enable-if, autoprune-unless, merge-dirs, subdirectory-suffix, locale-subset, version, versions. Hit up the flatpak metadata documentation for the deets on those. 📖

📦 Module

Each module is a source that has to be built and installed separately 💅. It holds the build options plus a list of sources to download and extract before building.

Modules can be nested, so you can flip related modules on and off with a single key. But heads up: module scopes are always isolated, so nested modules do not inherit attributes from their parents. Not even a little. 🙈

Accepted properties:

name (string) — the module's name, used in like build logs and stuff. It's also used to construct filenames and commandline arguments, so putting spaces or / in here is a bad idea. Don't do it bestie. 😭
disabled (boolean) — if true, skip this module entirely.
sources (array of objects or strings) — an array of objects defining sources that get downloaded and extracted in order. String members in the array are read as the name of a separate json or yaml file containing sources. More on that below. 👇
secret-env (array of strings) — which host environment variables get transferred to the build-commands or post-install environment. 🤫
config-opts (array of strings) — options passed to configure.
secret-opts (array of strings) — options passed to configure, meant for passing secrets through host environment variables. Put the option with an environment variable and it gets resolved beforehand. Like this:

'-DSECRET_ID=$CI_SECRET'

make-args (array of strings) — arguments passed to make.
make-install-args (array of strings) — arguments passed to make install.
rm-configure (boolean) — if true, yeet the configure script before starting the build. This requires the configure script to actually exist in the source directory. No script, no removal. 🚫
no-autogen (boolean) — ignore that an autogen script exists.
no-parallel-make (boolean) — don't call make with arguments to build in parallel.
install-rule (string) — the name of the rule passed to make for the install phase. Default is install.
no-make-install (boolean) — don't run the make install (or equivalent) stage.
no-python-timestamp-fix (boolean) — don't fix up the *.py[oc] header timestamps for ostree use.
cmake (boolean) — use cmake instead of configure. Deprecated: use buildsystem instead. ⚠️
buildsystem (string) — which build system to use: autotools, cmake, cmake-ninja, meson, simple, qmake.
builddir (boolean) — use a build directory that's separate from the source directory.
subdir (string) — build inside this subdirectory of the extracted sources.
build-options (object) — a build options object that can override the global options. Just a reminder: this is not inherited by nested modules. 🫠
build-commands (array of strings) — commands to run during build (between make and make install, if those are being used). This is mainly useful when you're on the "simple" buildsystem. Each command runs in /bin/sh -c, so it can use standard POSIX shell syntax like piping output 🌀. If any individual entry in the array fails, the whole build process fails — just like commands in a make(1) recipe.
post-install (array of strings) — shell commands run after the install phase. Great for cleaning up the install dir or installing extra files. 🧹
cleanup (array of strings) — file patterns that get removed at the end. Patterns starting with / are treated as full pathnames (without the /app prefix); otherwise they just match the basename. And ngl — those patterns will only match files installed by this module.
ensure-writable (array of strings) — here's how the builder works: files in the install directory are hard-links to the cached files, so you're not allowed to modify them in-place. List a file here and the hardlink gets broken so you can modify it. This is a workaround, bestie — ideally installing files should replace files, not modify existing ones. 🩹
only-arches (array of strings) — if non-empty, only build the module on the arches listed.
skip-arches (array of strings) — don't build on any of the arches listed.
cleanup-platform (array of strings) — extra files to clean up in the platform.
run-tests (boolean) — if true, this runs the tests after installing. 🧪
test-rule (string) — the target to build when running the tests. Defaults to "check" for make and "test" for ninja. Set it to empty to disable.
test-commands (array of strings) — commands to run during the tests.
license-files (array of strings) — paths to LICENSE files of the module. 📜
modules (array of objects or strings) — an array of objects specifying nested modules to build before this one. String members in the array are interpreted as names of a separate json or yaml file containing a module. 🪆

🌈 Sources

These hold a pointer to the source that gets extracted into the source directory before the build starts. They come in several types, told apart by the type property.

Also — the sources list can contain a plain string, which is interpreted as the name of a separate json or yaml file that gets read and inserted right at that point ✨. That file can hold a single source, or an array of sources.

🌟 All sources

only-arches (array of strings) — if non-empty, only build the module on the arches listed.
skip-arches (array of strings) — don't build on any of the arches listed.
dest (string) — directory inside the source dir where this source gets extracted.

🗜️ Archive sources (tar, zip)

type — must be "archive".
path (string) — the path of the archive.
url (string) — the URL of a remote archive that gets downloaded 🌐. This overrides path if both are specified.
mirror-urls (array of strings) — a list of alternative urls used if the main url fails. backups for your backups 💖
referer (string) — sets the HTTP "Referer" header when downloading the archive.
disable-http-decompression (boolean) — disables decompression of downloads over HTTP, for those misconfigured servers. 🙃
git-init (boolean) — whether to initialise the repository as a git repository.
archive-type (string) — the type of archive, in case it can't be guessed from the path. Possible values: "rpm", "tar", "tar-gzip", "tar-compress", "tar-bzip2", "tar-lzip", "tar-lzma", "tar-lzop", "tar-xz", "tar-zst", "zip" and "7z".
md5 (string) — the md5 checksum of the file, verified after download. ✅

okay bestie this next option is lowkey a jumpscare, read the note 💀

md5 (string) — the md5 checksum of the file, verified after download. This one's optional for local files.

fr fr, md5 is not considered a safe checksum anymore — we recommend you use at least sha256. like, please. i'm begging. 🙏

sha1 (string) — the sha1 checksum of the file, verified after download. Also optional for local files.

and no, sha1 is not considered a safe checksum either — recommend you use at least sha256. iykyk. 💅

sha256 (string) — the sha256 checksum of the file, verified after download. Optional for local files. this one is the safe bestie ✨
sha512 (string) — the sha512 checksum of the file, verified after download. Optional for local files. also iconic, also safe ✨
strip-components (integer) — how many initial pathname components get stripped during extraction. defaults to 1.
dest-filename (string) — the filename for the downloaded file. defaults to the basename of url. 🎀

🌈 Git sources

type — the string "git", that's it, that's the vibe.
path (string) — the path to a local checkout of the git repository. because of how git-clone works, this is gonna be so much faster than handing it a URL of file:///.... no cap.
url (string) — the URL of the git repository. this one overrides path if you specify both, so like, pick one. and when you're using git over SSH, the correct syntax is ssh://user@domain/path/to/repo.git. don't freestyle it.
branch (string) — the branch to use from the git repository. as of 1.2.3 it'll try to auto-detect the upstream default branch. previously this defaulted to master. 👑
tag (string) — the tag to use from the git repository.
commit (string) — the commit to use from the git repository. if branch is also specified, then it gets verified that the branch/tag is at this specific commit. it's a readable way to document that you're using a particular tag, but also verify that it doesn't change. chef's kiss security move 🫶
disable-fsckobjects (boolean) — don't use transfer.fsckObjects=1 to mirror the git repository. this may be needed for some (broken) repositories. 😭
disable-shallow-clone (boolean) — don't optimize by making a shallow clone when downloading the git repo.
disable-submodules (boolean) — don't checkout the git submodules when cloning the repository.
disable-lfs (boolean) — don't explicitly fetch or checkout LFS git objects. this will be ignored by Git if LFS filters are active in system or global gitconfig.

🍓 Bzr sources

type — the string "bzr".
url (string) — URL of the bzr repository.
revision (string) — a specific revision to use in the branch.

🧚 Svn sources

type — the string "svn".
url (string) — URL of the svn repository, including the branch/tag part.
revision (string) — a specific revision number to use.

🦋 Directory sources

type — the string "dir".
path (string) — the path of a local directory whose content will be copied into the source dir.

heads up: directory sources don't currently support caching, so they'll be rebuilt each time. every. single. time. 😮‍💨

skip (array of strings) — source files to ignore in the directory.

💜 File sources

type — the string "file".
path (string) — the path of a local file that will be copied into the source dir.
url (string) — the URL of a remote file that will be downloaded and copied into the source dir. this overrides path if both are specified.
mirror-urls (array of strings) — a list of alternative urls that are used if the main url fails. backup besties fr. 🫶
referer (string) — sets the HTTP "Referer" header when downloading the file.
disable-http-decompression (boolean) — disables decompression of downloads over HTTP for misconfigured servers. (misconfigured server behavior, not yours, not your fault)
md5 (string) — the md5 checksum of the file, verified after download. this is optional for local files.

md5 is no longer considered a safe checksum — we recommend you use at least sha256.

sha1 (string) — the sha1 checksum of the file, verified after download. optional for local files.

same deal, sha1 is no longer considered a safe checksum — use at least sha256. periodt.

sha256 (string) — the sha256 checksum of the file, verified after download. that's optional for local files. 💖
sha512 (string) — the sha512 checksum of the file, verified after download. also optional for local files. 💖
dest-filename (string) — the filename to use inside the source dir, defaults to the basename of path. 🎀

⭐ Script sources

this is a way to create a shell (/bin/sh) script out of an inline set of commands. cute, right?

type — the string "script".
commands (array of strings) — an array of shell commands that will be put in a shellscript file.
dest-filename (string) — the filename to use inside the source dir, defaults to autogen.sh. yes, that autogen.sh. 😭

🌸 Inline data sources

this is a way to create a file with given contents. main character energy for tiny files ✨

type — the string "inline".
dest-filename (string) — the filename to use inside the source dir.
contents (string) — text data that will be put in the file.
base64 (boolean) — whether the content is base64-encoded.

💅 Shell sources

this is a way to create/modify the sources by running shell commands.

type — the string "shell".
commands (array of strings) — an array of shell commands that will be run during source extraction.

🎀 Patch sources

type — the string "patch".
path (string) — the path of a patch file that will be applied in the source dir.
paths (array of strings) — a list of paths to patch files that will be applied in the source dir, in order. (yes, the original says "an list". we don't judge, we just apply patches in order 💖)
strip-components (integer) — the value of the -p argument to patch, defaults to 1.
use-git (boolean) — whether to use git apply rather than patch to apply the patch. required when the patch file contains binary diffs.
use-git-am (boolean) — whether to use git am rather than patch to apply the patch. required when the patch file contains binary diffs.

you cannot use this at the same time as use-git. pick a lane bestie 😤

options (array of strings) — extra options to pass to the patch command.

🔥 Extra data sources

type — the string "extra-data".
filename (string) — the name to use for the downloaded extra data.
url (string) — the url to the extra data.
sha256 (string) — the sha256 of the extra data.
size (number) — the size of the extra data in bytes.
installed-size (string) — the extra installed size this adds to the app. optional. 💜

🔨 BUILD ENVIRONMENT 🔨

okay so when building the application, each command gets run in a separate sandbox with access to only the things it actually requires. this section describes the details of that sandbox. any options here can be overridden globally or per-module with the build-args option — although, plot twist, such a manifest will not work if you start flatpak-builder with --sandbox. 😬

📁 Filesystem

each module is built in its own build directory, stored in a sub directory called build/$modulename-$count in the state dir (which is typically .flatpak-builder/). additionally there's a symlink build/$modulename pointing to the latest version. 👑

and in order to generate reproducible builds, this directory is also mounted as /run/build/$modulename in the sandbox (or /run/build-runtime/$modulename when building runtimes) and also as /run/active-build since 1.4.7. this is used as the current working directory for all build ops.

the destination directory for installation is accessible for writing at the place it'll be seen at runtime. in the case of a regular application this will be /app. if you're building a runtime it'll instead be /usr, and when building an extension it'll be at the extensionpoint directory somewhere below /app (for app extension) or /usr (for runtime extensions).

additionally there will be (as needed, depending on what's building) read-only mounts of the sdk at /usr, sdk extensions below that, and the application at /app. no other filesystem access is available. that's the whole world. 🌍

🌈 Environment

the environment can be modified in several ways in the manifest, but the default values are:

FLATPAK_ID — the id of the application currently building.
FLATPAK_ARCH — the architecture currently building.
FLATPAK_DEST — the path to where the current build should install into. this is /app for application builds.
FLATPAK_BUILDER_N_JOBS — the number of jobs that flatpak-builder would normally use for make -j. defaults to ncpus unless the module disabled parallel make.
FLATPAK_BUILDER_BUILDDIR — the path to the build directory of the module currently building. this is normally /run/build/$MODULE.
PATH — /app/bin:/usr/bin
LD_LIBRARY_PATH — /app/lib
PKG_CONFIG_PATH — /app/lib/pkgconfig:/app/share/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig
ACLOCAL_PATH — /app/share/aclocal
C_INCLUDE_PATH — /app/include
CPLUS_INCLUDE_PATH — /app/include
LDFLAGS — -L/app/lib
LC_ALL — en_US.utf8

🔐 Permissions

builds have the --allow=devel and --allow=multiarch permissions that regular flatpak runs don't have by default. this limits the syscall filtering that's normally done so development tools like debuggers actually work. otherwise the build sandbox is very limited — for example, there is no network access. offline era fr. 📵

✨ EXAMPLES ✨

okay bestie, time for the part you've been waiting for — actual receipts 💅 here's the whole vibe in action:

$ flatpak-builder my-app-dir manifest.json

that's it. that's the whole command. you point it at your app dir and your manifest and it goes 🏃‍♀️💨

and here's what an example manifest file looks like, in all its glory, no cap:

{
    "id": "org.test.TestApp",
    "runtime": "org.freedesktop.Platform",
    "runtime-version": "1.2",
    "sdk": "org.freedesktop.Sdk",
    "command": "test",
    "clean": [ "/include", "*.la" ],
    "build-options" : {
        "cflags": "-O2 -g",
        "cxxflags": "-O2 -g",
        "env": {
            "V": "1"
        },
        "arch": {
            "x86_64": {
                "cflags": "-O3 -g",
            }
        }
    },
    "modules": [
        {
            "name": "pygobject",
            "config-opts": [ "--disable-introspection" ],
            "sources": [
                {
                    "type": "archive",
                    "url": "http://ftp.gnome.org/pub/GNOME/sources/pygobject/2.28/pygobject-2.28.6.tar.xz",
                    "sha256": "fb8a1d4f665130a125011659bd347c7339c944232163dbb9a34fd0686577adb8"
                },
                {
                    "type": "patch",
                    "path": "required-pygobject-fix.patch"
                },
                {
                    "type": "file",
                    "path": "pygobject-extra-file",
                    "dest-filename": "extra-file"
                }
            ]
        },
        {
            "name": "babl",
            "build-options" : { "cxxflags": "-O2 -g -std=c++11" },
            "cleanup": [ "/bin" ],
            "sources": [
                {
                    "type": "git",
                    "url": "https://gitlab.gnome.org/GNOME/babl.git"
                }
            ]
        },
        {
            "name": "testapp",
            "sources": [
                {
                    "type": "bzr",
                    "url": "lp:testapp"
                }
            ]
        }
    ]
}

look at that structure. chef's kiss 🤌 three modules, three whole different source types living their best lives — an archive with its sha256, a patch, a file, then a git source, then a bzr source. and the global clean list, the per-module cleanup, the build-options with cflags, cxxflags, env and even a per-arch override for x86_64. every single field is out here doing its job 🎀

ngl bestie, do NOT copy the trailing commas — the original shows them and they're giving "technically invalid JSON" energy. write clean JSON in your real manifest, k? 💀

👀 SEE ALSO 👀

flatpak-builder(1) — the main character. go read it, it's literally the thing that eats this manifest for breakfast 🍓

okay and that's a wrap on the whole page, bestie! 🫶 you made it through all of it, and honestly? iconic behavior. go build something cute.

this page comes to you courtesy of flatpak, and it lives under the name FLATPAK MANIFEST(5) — so if you ever need to find it again, that's your search term ✨ happy building, go slay 💖🌸

📦 where this page comes from

alpine 3.24: flatpak-builder-doc 1.4.11-r0 · LGPL-2.1-or-later
arch rolling: flatpak-builder 1.4.12-1 · LGPL-2.1-or-later
ubuntu stonking: flatpak-builder 1.4.12-1
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms