Submitting a release

Release submission is not open yet. How to prepare a Flatpak manifest that builds offline on the Luma runtime, the checks Luma runs on every release on its remote, and what the submission form will ask for.

Prepare the manifest

Luma builds exactly what your manifest describes, so:

Pin every source. git sources use a full 40-character commit (a tag alone is not enough); archive and file sources declare sha256. Luma’s build refuses a git source without a full commit, and luma release-check reports any unpinned source.
Vendor build-time downloads. Assume the build has no network access, as on Flathub. Generate sources for language package managers (Python wheels, Cargo crates, npm packages) with the flatpak-builder-tools generators and commit the result.
Use the Luma runtime: runtime org.projectluma.Platform, sdk org.projectluma.Sdk, runtime-version 44.
Keep finish-args minimal. Every entry becomes a permission people see. See permissions and privacy.
Install metainfo, the desktop entry and the icon under /app/share, named with your app ID.

Test the build yourself

Run the same tools Luma runs, from a clean checkout:

Shell

flatpak run org.flatpak.Builder --user --force-clean --install-deps-from=luma \
  --repo=repo build flatpak/com.example.Notebook.json
flatpak run --command=flatpak-builder-lint org.flatpak.Builder manifest flatpak/com.example.Notebook.json
flatpak run --command=flatpak-builder-lint org.flatpak.Builder repo repo
appstreamcli validate --no-net data/com.example.Notebook.metainfo.xml
desktop-file-validate data/com.example.Notebook.desktop
luma lint

The build step needs the luma remote and its runtime and SDK; see install the SDK and runtimes and distributions.

The checks every release runs

These run, in order, on every release Luma publishes to its remote:

Check	Fails the release when
Build	The manifest does not build with `flatpak-builder`, or a `git` source is not pinned to a full commit
`appstreamcli validate --no-net`	The metainfo has errors
`desktop-file-validate`	The desktop entry has errors
`flatpak-builder-lint`	The manifest, build directory or exported repository has errors
Permissions	Never fails. It computes the permission list from the built app and compares it with the release already published on the same branch.

flatpak-builder-lint encodes some Flathub policy that does not apply to the Luma remote, such as Flathub’s own list of runtimes. Luma skips those named checks; every other lint error fails the build.

If the permission comparison shows that the release asks for more than the published one, the release is held and is not signed until a person approves the change. See updates and permission changes.

Give every release a version newer than the last one, with a matching <release> entry in your metainfo.

What the submission form will ask for

	Source mode	Bundle mode
For	Open source apps, and every Luma tier app	Proprietary apps only
You give	A repository URL, a tag or full commit (branches move, so they are not accepted), and the path to your Flatpak manifest	A signed `.flatpak` bundle you built, up to 1 GiB
Who builds	Luma, with the checks above	You; Luma checks the bundle

Both modes also take release notes, shown in Depot with the version, and a branch: beta or stable.

A bundle must still use the Luma runtime. For example:

Shell

flatpak-builder --force-clean --repo=repo build com.example.Notebook.json
flatpak build-bundle --gpg-sign=<your-key-id> repo notebook.flatpak com.example.Notebook stable

Review

After the automated checks pass:

Verified tier: a person reviews your first release, and any release whose permissions grow. Other releases publish after the checks.
Luma tier: every release gets a person’s design and privacy review.

Reviewers approve, request changes with a reason, or reject with a reason. See the review guidelines.

Branches

beta is for people who choose to test.
stable is what everyone gets.

Each app on the remote has a .flatpakref file for each branch it is on. See Open in Depot links.

After publishing

The release is signed into the Luma remote with the Luma Depot key, the remote’s summary and static deltas are regenerated, and the result is synced to dl.simplyluma.com. Installed copies update through Flatpak; see updates and permission changes.