Alien apps on the Linux desktop: install and verify the Flatpak

Four of my apps are available for the Linux desktop: Alien Pass (since v1.7), the Sachwert-Tresor (since v3.3), Alien Notes (since v0.1) and the BTC Steuertool (since v1.0, October 2026). All four run as a Flatpak (x86_64) with the same shell: no network, no file access, files only through the system dialog. They are deliberately not on Flathub and do not update themselves — you download the file from the release (GitHub or our own download address), verify the signature and install it yourself. This page shows the way once for all four apps.

1. Prerequisite: Flatpak with Flathub

The apps need the runtime org.freedesktop.Platform 25.08, which Flatpak fetches from Flathub during installation. Once, as a user (no root, no sudo):

flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

2. Download three files from the release

From the latest release you need the bundle, the checksum file and its signature:

• Alien Pass: alien-pass-X.Y-linux-x86_64.flatpak, SHA256SUMS, SHA256SUMS.asc
• Sachwert-Tresor: sachwert-tresor-X.Y-linux-x86_64.flatpak, SHA256SUMS, SHA256SUMS.asc
• Alien Notes: alien-notes-X.Y-linux-x86_64.flatpak, SHA256SUMS, SHA256SUMS.asc
• BTC Steuertool: btc-steuertool-X.Y-linux-x86_64.flatpak, SHA256SUMS, SHA256SUMS.asc

The same files are also on our own download address at api.alien-investor.org/downloads/<app>/ (alien-pass, sachwert-tresor, alien-notes, steuertool); the bundle's name is listed in the SHA256SUMS file.

An -rN in the file name (such as alien-pass-1.8-r2-…) is a rebuild of the shell with the app unchanged.

3. Verify authenticity: GPG-signed checksum

The file SHA256SUMS is signed with the Alien Investor GPG release key — the same key for all desktop apps. The public part is here on the website (alien-investor-release-key.asc) and in all repos. Compare the fingerprint through a second channel before trusting the key:

100F 9E25 BFAE A807 DBC3  57D7 50C0 D785 83BF CB81

gpg --show-keys alien-investor-release-key.asc   # prints the fingerprint — compare with the line above
gpg --import alien-investor-release-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS      # expected: Good signature from "Alien Investor (Release-Signatur) …"
sha256sum -c SHA256SUMS                     # expected: …flatpak: OK

The checksum is signed, not the bundle itself — hence both commands: gpg --verify proves the checksum comes from me, sha256sum -c proves the bundle matches that checksum. If either fails, do not install.

4. Install and run

flatpak install --user alien-pass-X.Y-linux-x86_64.flatpak
flatpak run org.alieninvestor.pass

flatpak install --user sachwert-tresor-X.Y-linux-x86_64.flatpak
flatpak run org.alieninvestor.tresor

flatpak install --user alien-notes-X.Y-linux-x86_64.flatpak
flatpak run org.alieninvestor.notes

flatpak install --user btc-steuertool-X.Y-linux-x86_64.flatpak
flatpak run org.alieninvestor.steuertool

The apps then appear in the application menu. A backup from the phone (.vault, for Alien Notes .notes) is imported through the file dialog — the format is identical (the tax tool has no backup, it only reads your CSVs).

5. Update: uninstall, reinstall

Flatpak (as of 1.14) does not install a new bundle over an existing installation. Download and verify the new version (steps 2 and 3), then:

flatpak uninstall --user org.alieninvestor.pass       # deletes NO data (without --delete-data)
flatpak install --user alien-pass-X.Y-linux-x86_64.flatpak

For the vault the same with org.alieninvestor.tresor, for Alien Notes with org.alieninvestor.notes, for the BTC Steuertool with org.alieninvestor.steuertool. Your data stays in place:

• Alien Pass: ~/.var/app/org.alieninvestor.pass/data/alien-pass/vault.aipv
• Sachwert-Tresor: ~/.var/app/org.alieninvestor.tresor/data/sachwert-tresor/vault.aisv
• Alien Notes: ~/.var/app/org.alieninvestor.notes/data/alien-notes/notes.ainv
• BTC Steuertool: stores no tax data (only language and theme) — CSVs and reports stay wherever you saved them.

Still make a backup before every update. Close a running window first — otherwise the old version keeps running.

6. Check for yourself that the app has no network

flatpak info --user --show-permissions org.alieninvestor.pass

Expected exactly this output (identical for the vault, Alien Notes and the BTC Steuertool):

[Context]
shared=ipc;
sockets=wayland;fallback-x11;
devices=dri;

No network, no filesystem. This is not a setting inside the app but the system itself: inside the Flatpak sandbox there is no network without the network permission, and the app only reaches files you pick in the dialog.