About - Flatsonar

The hunt

Most stores list what people submit. Flatsonar goes looking. The crawler walks:

Flathub: API v2 for metadata and the deployed permissions, plus the github.com/flathub/<id> manifest for sources, which is where the upstream repository and creator credit come from.
GitHub, GitLab, Codeberg: repositories tagged flatpak (and code search, with a token) whose tree contains a reverse.dns.Name.{json,yml,yaml} manifest. The .metainfo.xml gives the name, summary, license and screenshots; FUNDING.yml and AppStream <url type="donation"> give the Sponsor buttons.

Release assets ending in .flatpak become one-click bundle installs, .flatpakrepo files become remotes, and anything that only has a manifest is built locally with flatpak-builder.

Only OSI/FSF-approved SPDX licenses are listed. Proprietary apps on Flathub are skipped. Verification is never a filter: unverified publishers are indexed like everyone else and labelled honestly.

Right now: 5,131 apps, 2,130 of them found outside Flathub, 1,204 with a sponsor link.

Who publishes this?

An app id is a claim. io.github.alice.Foo says “alice on GitHub made this”; org.mozilla.firefox says “Mozilla made this”. Flathub checks that claim by hand. Flatsonar re-derives the rules and applies them to wherever the manifest was actually found. Every app gets one of four levels:

Verified	The creator demonstrably controls the id: Flathub verification, or the hosting account owns the namespace (`io.github.alice.` hosted by alice, `org.gnome.` on gitlab.gnome.org, …), or the id's domain serves `/.well-known/org.flathub.VerifiedApps.txt` listing it.
Reviewed	On Flathub: manifest reviewed and built by Flathub, but the developer has not verified the id.
Unverified	Off Flathub and ownership could not be confirmed (a custom domain with no well-known file, or a third-party packager building someone else's code). Nothing known against it.
Suspicious	A concrete red flag: the id claims a namespace the repository neither owns nor builds from, or the build does things a build should not, or a bundle is served over plain HTTP.

Yellow notes never downgrade an app on their own (a repository that is three days old with no stars, a name shared with a Flathub app, an id someone else also publishes), but they are listed before installing.

One app id, one publisher. Flathub always keeps its row, and a repository claiming a Flathub app's id may only enrich it when it is the repository Flathub builds from, so nobody can plant a sponsor button on someone else's app. Between two off-Flathub publishers the first one seen keeps the id unless the newcomer is strictly more trusted: the real owner turning up after a copy.

Before anything is built, the manifest itself is audited: extra-data downloaded at install time after any scan, sources over plain http://, archives without a checksum, git sources tracking a branch, prebuilt binaries instead of source, build arguments that open the build sandbox, and build commands such as curl | sh, base64 -d, setuid bits or flatpak-spawn --host.

How the warning works

The desktop app's install flow has two gates, because two different things can be wrong.

Gate one, before anything runs

The publisher findings above plus, for apps built locally from a manifest, a fresh audit of the manifest that was just downloaded (never the index's copy); it must also build the app id it claims. For manifest installs this gate comes before flatpak-builder starts: the build is the risk. Installing from a project's own remote also warns that future updates will come from that remote.

Gate two, after pull or build

flatpak install --no-deploy pulls the app into the local OSTree repository without deploying it (or flatpak-builder builds it into a local repository).
ostree checkout materialises the files; ClamAV scans them.
The deployed metadata file is parsed back into finish-args and scored: host filesystem, --device=all, session or system bus, sandbox escape via org.freedesktop.Flatpak, LD_PRELOAD, credential paths → red; X11, home folder, keyring → yellow. The index's score is only a preview; the real files decide.
Yellow or red: dialog one lists the findings, dialog two says it is on you. Two Sures and it deploys. Accepted findings are remembered per app until they change, so updates only ask again when they add something.

An unverified publisher alone is yellow: a perfectly sandboxed app from someone nobody has vouched for still gets the two dialogs. A suspicious one is red.

Flatsonar packaged as a Flatpak scores red by its own rules: a store has to talk to org.freedesktop.Flatpak to install things on the host. That is the honest answer.

Get the app

The desktop client is a GTK4 / libadwaita app for Linux. It is early: today it runs from source.

git clone https://github.com/abutauskas/flatsonar.git && cd flatsonar
./scripts/setup-wsl.sh            # GTK4, libadwaita, flatpak, clamav (Debian/Ubuntu)
pip install --user -e core -e client
FLATSONAR_API=https://flatsonar.org python -m flatsonar

Press Ctrl+I for the Installed page: every Flatpak on the machine, user and system, scored from its deployed permissions (whether or not Flatsonar installed it), with Update wherever something newer exists.

For developers: getting listed

There is nothing to submit. Make your project findable and the hunt will find it:

Keep a flatpak-builder manifest in your repository named after your app id: io.github.you.App.json or .yml.
Ship an AppStream io.github.you.App.metainfo.xml: name, summary, description, screenshots, license, releases. That is what the listing is made of.
Add the flatpak topic to the repository.
Add a FUNDING.yml or a <url type="donation"> and your listing gets a Sponsor button.
Use an id you own. io.github.you.* is verified automatically when the repository is under you; a custom domain is verified by serving https://your.domain/.well-known/org.flathub.VerifiedApps.txt with the id on a line.
Pin your sources (sha256 for archives, commit for git), keep finish-args tight, and the badges take care of themselves.

Don't want your project here at all? Add the topic noflatsonar (or no-flatsonar) to the repository and the next crawl removes it, without reading anything further.

Something wrong with a listing: credit, license, an impostor? Open an issue.

API

Everything on this site is available as JSON at /api: /api/apps?q=&category=&risk=&trust=&sort=, /api/apps/{id}, /api/apps/{id}/manifest, /api/categories and /api/stats. New apps are also published as an Atom feed.

Flatsonar is free software under the GPL-3.0-or-later. Every app listed belongs to its own authors under its own license. Flatsonar just points at them. Source on GitHub.