feat: add submission-ready Flathub manifest variant

New self-contained desktopApp/packaging/flatpak/flathub/ directory whose
contents are copied verbatim into the flathub per-app repo at submission
time (Flathub has no separate accounts — submission is a GitHub PR):

- manifest builds from the published GH Release tarball (pinned to
  v1.12.6 url + sha256 from the release asset digest) instead of the
  local type:dir tree CI uses — Flathub build servers must fetch all
  sources themselves
- x-checker-data (json type, is-main-source) on the archive source so
  flatpak-external-data-checker auto-PRs url/sha256 bumps and metainfo
  <release> entries on every new GitHub Release
- own metainfo copy carrying the permanent <releases> history Flathub
  requires (the CI variant keeps injecting its entry at build time);
  screenshots remain the documented submission blocker
- flathub.json restricting builds to x86_64 (no aarch64 tarball exists
  and jpackage cannot cross-compile one)

Verified locally: built the flathub manifest end-to-end from the real
v1.12.6 tarball (sha256 enforced by flatpak-builder), installed it, and
booted the actual app inside the sandbox under Xvfb — UI rendered and
the embedded Tor daemon spawned.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GYfNxhPZC3WRrn82Dm2Cb4

.gitignore

@@ -182,8 +182,8 @@ desktopApp/packaging/appimage/squashfs-root/
 
 # flatpak-builder state/cache from local builds (CI uses --state-dir under desktopApp/build/)
 .flatpak-builder/
-desktopApp/packaging/flatpak/build-dir/
-desktopApp/packaging/flatpak/repo/
+desktopApp/packaging/flatpak/**/build-dir/
+desktopApp/packaging/flatpak/**/repo/
 
 # Git worktrees
 .worktrees/

desktopApp/packaging/flatpak/README.md

@@ -6,10 +6,10 @@ used two ways:
 1. **Release CI** (`.github/workflows/create-release.yml`, `linux-portable`
    leg) builds a single-file bundle from it on every tag and attaches it to
    the GitHub Release as `amethyst-desktop-<version>-linux-x64.flatpak`.
-2. **Flathub submission** (future) — the same manifest is the starting
-   point, but Flathub requires building from downloadable sources instead of
-   the local `type: dir` tree, so it will need a source rewrite at
-   submission time.
+2. **Flathub submission** — the `flathub/` subdirectory holds a
+   submission-ready variant that builds from the published GitHub Release
+   tarball (Flathub's build servers must fetch sources themselves; the
+   local `type: dir` tree used by CI is not allowed there).
 
 ## Files
 
@@ -24,6 +24,12 @@ used two ways:
 - `com.vitorpamplona.amethyst.Desktop.desktop` — XDG desktop entry
 - `icons/512/com.vitorpamplona.amethyst.Desktop.png` — 512x512 icon (copy of
   `desktopApp/src/jvmMain/resources/icon.png`)
+- `flathub/` — self-contained, copy-ready Flathub submission dir: its own
+  manifest (archive source pinned to the release tarball URL + sha256, with
+  `x-checker-data` so Flathub's update bot bumps it), its own metainfo
+  (carries the permanent `<releases>` history Flathub requires), desktop
+  entry, icon, and `flathub.json` (`only-arches: x86_64` — we publish no
+  aarch64 tarball, and jpackage can't cross-compile one)
 
 ## Local build
 
@@ -70,16 +76,28 @@ from Flathub automatically on the user's machine.
 
 ## Submission to Flathub
 
-Follow https://docs.flathub.org/docs/for-app-authors/submission
+Follow https://docs.flathub.org/docs/for-app-authors/submission — no
+separate Flathub account exists; everything runs through GitHub PRs.
+
+**Remaining blocker before submitting:** at least one screenshot with a
+publicly reachable URL in `flathub/….metainfo.xml` (the Flathub linter
+rejects the current empty placeholder).
 
 1. Fork `flathub/flathub` on GitHub.
 2. Branch from `new-pr` (NOT `master`).
-3. Copy this manifest + AppStream + desktop into a new directory matching
-   the app id, and rework the `type: dir` source into a
-   buildable-from-source or downloadable-artifact form per Flathub policy.
+3. Copy the contents of `flathub/` verbatim into a new top-level directory
+   named `com.vitorpamplona.amethyst.Desktop`.
 4. Open a PR titled "Add com.vitorpamplona.amethyst.Desktop".
-5. After merge, a per-app repo is created with write access for ongoing
-   updates.
+5. After merge, Flathub creates a per-app repo
+   (`flathub/com.vitorpamplona.amethyst.Desktop`) with write access for
+   ongoing updates. Its `x-checker-data` makes
+   flatpak-external-data-checker open update PRs there automatically on
+   each new GitHub Release (bumping url/sha256 and appending the metainfo
+   `<release>` entry).
+
+To test the Flathub variant locally, run the same flatpak-builder commands
+as above from inside `flathub/` — it downloads the pinned release tarball
+instead of using a local Gradle build.
 
 ## License metadata
 

desktopApp/packaging/flatpak/flathub/com.vitorpamplona.amethyst.Desktop.desktop

@@ -0,0 +1,9 @@
+[Desktop Entry]
+Type=Application
+Name=Amethyst Desktop
+Comment=Nostr client for desktop
+Categories=Network;InstantMessaging;
+Exec=amethyst-desktop
+Icon=com.vitorpamplona.amethyst.Desktop
+Terminal=false
+StartupWMClass=Amethyst

desktopApp/packaging/flatpak/flathub/com.vitorpamplona.amethyst.Desktop.metainfo.xml

@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<component type="desktop-application">
+  <id>com.vitorpamplona.amethyst.Desktop</id>
+  <metadata_license>CC0-1.0</metadata_license>
+  <project_license>MIT AND LGPL-2.1-or-later AND BSD-2-Clause AND Apache-2.0</project_license>
+  <name>Amethyst Desktop</name>
+  <summary>Nostr client for desktop</summary>
+
+  <description>
+    <p>
+      Amethyst Desktop is a desktop client for the Nostr protocol.
+      Browse feeds, post notes, send zaps (Lightning Network), and
+      participate in NIP-53 live audio rooms.
+    </p>
+  </description>
+
+  <launchable type="desktop-id">com.vitorpamplona.amethyst.Desktop.desktop</launchable>
+
+  <url type="homepage">https://github.com/vitorpamplona/amethyst</url>
+  <url type="bugtracker">https://github.com/vitorpamplona/amethyst/issues</url>
+  <url type="vcs-browser">https://github.com/vitorpamplona/amethyst</url>
+
+  <developer id="com.vitorpamplona">
+    <name>Vitor Pamplona</name>
+  </developer>
+
+  <content_rating type="oars-1.1" />
+
+  <categories>
+    <category>Network</category>
+    <category>InstantMessaging</category>
+  </categories>
+
+  <screenshots>
+    <!-- BLOCKER for Flathub submission: at least one screenshot with a
+         publicly reachable <image> URL is required by the Flathub linter.
+         Suggested 1280x800 PNG, e.g.:
+    <screenshot type="default">
+      <image>https://raw.githubusercontent.com/vitorpamplona/amethyst/main/docs/screenshots/desktop-home.png</image>
+      <caption>Home feed</caption>
+    </screenshot>
+    -->
+  </screenshots>
+
+  <!-- Unlike the CI metainfo (release entry injected at build time), Flathub
+       requires the release history to live in-repo. New entries are appended
+       automatically by flatpak-external-data-checker (is-main-source: true
+       on the archive source in the manifest). -->
+  <releases>
+    <release version="1.12.6" date="2026-06-19" />
+  </releases>
+</component>

desktopApp/packaging/flatpak/flathub/com.vitorpamplona.amethyst.Desktop.yml

@@ -0,0 +1,98 @@
+# Flathub submission manifest for Amethyst Desktop.
+#
+# Unlike ../com.vitorpamplona.amethyst.Desktop.yml (which packages the locally
+# built tree for release CI), this variant builds from the published GitHub
+# Release tarball — Flathub's build servers must be able to fetch every source
+# themselves. This directory is copy-ready: everything in it (manifest,
+# metainfo, desktop entry, icon, flathub.json) is exactly what gets committed
+# to the flathub per-app repo at submission time.
+#
+# Update flow after each Amethyst release: bump url + sha256 on the archive
+# source and append a <release> entry to the metainfo. The x-checker-data
+# block below lets Flathub's flatpak-external-data-checker bot do both
+# automatically once the app is published.
+
+app-id: com.vitorpamplona.amethyst.Desktop
+runtime: org.freedesktop.Platform
+runtime-version: '24.08'
+sdk: org.freedesktop.Sdk
+command: amethyst-desktop
+
+add-extensions:
+  org.freedesktop.Platform.ffmpeg-full:
+    directory: lib/ffmpeg
+    version: '24.08'
+    add-ld-path: .
+    autodownload: true
+    autodelete: false
+
+cleanup-commands:
+  - mkdir -p /app/lib/ffmpeg
+
+finish-args:
+  - --share=network
+  - --share=ipc
+  # Compose Desktop renders through AWT/skiko, which is X11-only on Linux
+  # (runs under XWayland on Wayland sessions). fallback-x11 + wayland would
+  # leave the app without a usable display socket on Wayland sessions, so
+  # grant x11 unconditionally.
+  - --socket=x11
+  - --socket=pulseaudio
+  - --device=dri
+  - --filesystem=xdg-download
+  - --filesystem=xdg-pictures
+  - --talk-name=org.freedesktop.Notifications
+  - --talk-name=org.freedesktop.secrets
+  # GStreamer plugin/cache paths (org.freedesktop.Platform exposes them by default).
+  - --env=GST_PLUGIN_SYSTEM_PATH=/usr/lib/x86_64-linux-gnu/gstreamer-1.0
+
+# No openjdk module / sdk-extension: the jpackage tree in the release tarball
+# already bundles its own trimmed JRE under Amethyst/lib/runtime/.
+modules:
+  - name: amethyst-desktop
+    buildsystem: simple
+    build-commands:
+      # Drop the jpackage-emitted self-contained tree into /app/lib/Amethyst.
+      # Wrapper at /app/bin/amethyst-desktop forwards args.
+      - mkdir -p /app/lib/Amethyst
+      - cp -r ./Amethyst/* /app/lib/Amethyst/
+      - install -Dm755 amethyst-desktop.sh /app/bin/amethyst-desktop
+      - install -Dm644 com.vitorpamplona.amethyst.Desktop.metainfo.xml -t /app/share/metainfo/
+      - install -Dm644 com.vitorpamplona.amethyst.Desktop.desktop -t /app/share/applications/
+      - install -Dm644 icons/512/com.vitorpamplona.amethyst.Desktop.png -t /app/share/icons/hicolor/512x512/apps/
+    sources:
+      # jpackage self-contained tree published by release CI. The tarball
+      # carries a single Amethyst/ top-level dir — keep it (strip-components
+      # defaults to 1, which would flatten it away).
+      - type: archive
+        url: https://github.com/vitorpamplona/amethyst/releases/download/v1.12.6/amethyst-desktop-1.12.6-linux-x64.tar.gz
+        sha256: 42250027857b37f184ebca52bf6124ff6524be4bc15fedf819e4acaca8bc9538
+        strip-components: 0
+        # flatpak-external-data-checker: watches GitHub Releases and opens
+        # update PRs against the flathub repo (bumps url/sha256 above and,
+        # via is-main-source, appends the <release> entry to the metainfo).
+        x-checker-data:
+          type: json
+          is-main-source: true
+          url: https://api.github.com/repos/vitorpamplona/amethyst/releases/latest
+          version-query: .tag_name | sub("^v"; "")
+          timestamp-query: .published_at
+          url-query: '"https://github.com/vitorpamplona/amethyst/releases/download/"
+            + .tag_name + "/amethyst-desktop-" + (.tag_name | sub("^v"; ""))
+            + "-linux-x64.tar.gz"'
+
+      - type: script
+        dest-filename: amethyst-desktop.sh
+        commands:
+          - "#!/bin/sh"
+          - exec /app/lib/Amethyst/bin/Amethyst "$@"
+
+      - type: file
+        path: com.vitorpamplona.amethyst.Desktop.metainfo.xml
+
+      - type: file
+        path: com.vitorpamplona.amethyst.Desktop.desktop
+
+      - type: dir
+        path: icons
+        dest: icons

desktopApp/packaging/flatpak/flathub/flathub.json

@@ -0,0 +1,3 @@
+{
+    "only-arches": ["x86_64"]
+}