Opensidian

Open-source and non-profit under GPLv3, vault-compatible cross-platform markdown notes app. It's based on Rust + Tauri v2 and under heavy development. We're looking for Linux distribution maintainers. Not affiliated with or endorsed by Obsidian or Dynalist Inc.; "Obsidian" is their trademark. Opensidian is a clean-room functional clone: it reimplements Obsidian's behaviour from the outside and contains none of its code.

Install

Linux x86_64 — packages

Download one from the v0.9.4 release:

Download	Choose it if	Tested on
slim AppImage	you want the smallest file and have WebKitGTK 4.1	Fedora 44 (sudo dnf install webkit2gtk4.1), Ubuntu 26.04 LTS (sudo apt install libwebkit2gtk-4.1-0)
portable AppImage	you want nothing to install: WebKit is bundled (needs only the X11/GL/font libraries every desktop has)	Fedora 44, Ubuntu 26.04 LTS
Flatpak	you want it sandboxed; pulls the GNOME 49 runtime from Flathub on first install	Fedora 44, Ubuntu 26.04 LTS (flatpak package installed)
RPM	you run Fedora and want a system package with a menu entry and icon; dnf pulls WebKitGTK 4.1 for you	Fedora 44 (see the RPM note below)
DEB	you run Debian or Ubuntu and want a system package with a menu entry and icon; apt pulls WebKitGTK 4.1 for you	Debian 13, Ubuntu 26.04 LTS (sudo apt install ./opensidian-0.9.4-x86_64.deb)

Checksums and signature: SHA256SUMS, SHA256SUMS.asc (see Verify your download).

glibc ≥ 2.43, current distros only: the AppImages, DEB and RPM are built on Ubuntu 26 and need glibc 2.43 or newer, so they do not start on older distros such as Ubuntu 24.04 LTS or Debian 12. On an older distro, use the Flatpak, which brings its own runtime.

RPM on rpm 6 (e.g. Fedora 44): the RPM itself is not GPG-signed (as in v0.9.2), and rpm 6 rejects unsigned packages by default (does not verify: no signature). Verify the file first. Then install the dependencies from your signed Fedora repositories, and skip the signature check only for the one file you verified:

sudo dnf install webkit2gtk4.1                           # dependencies, signature-checked as usual
sudo rpm -Uvh --nosignature opensidian-0.9.4-x86_64.rpm  # install or upgrade; fetches nothing else

Avoid dnf install --nogpgcheck here: it also turns off the signature checks for every dependency in the same transaction.

A signed RPM is planned for the next release.

Nix & NixOS

nix profile add github:jpzk/opensidian

Verify your download

Put the file(s) you downloaded in one directory together with SHA256SUMS and SHA256SUMS.asc.

1. Signature: SHA256SUMS is signed with key A6E6 9ED6 BC47 79F3 2817 2148 4CC1 AFDE 15B6 4EA3 (the same key as v0.9.2 and v0.9.3):

   curl -LO https://github.com/jpzk/opensidian/releases/download/v0.9.4/SHA256SUMS \
        -LO https://github.com/jpzk/opensidian/releases/download/v0.9.4/SHA256SUMS.asc
   gpg --keyserver hkps://keys.openpgp.org --recv-keys A6E69ED6BC4779F3281721484CC1AFDE15B64EA3
   gpg --export A6E69ED6BC4779F3281721484CC1AFDE15B64EA3 > opensidian.gpg
   gpgv --keyring ./opensidian.gpg SHA256SUMS.asc SHA256SUMS   # accepts only this key

   Unlike a plain gpg --verify, gpgv with this one-key keyring rejects a signature made by any other key you may have.

2. Checksums: every file you downloaded must report OK:

   sha256sum -c --ignore-missing SHA256SUMS

3. Build provenance: v0.9.3 is the first release with GitHub artifact attestations (SLSA provenance). They prove each file was built by this repository's release.yml workflow on GitHub-hosted runners. With the GitHub CLI:

   # repeat for each file you downloaded
   gh attestation verify opensidian-0.9.4-x86_64.rpm -R jpzk/opensidian \
     --signer-workflow jpzk/opensidian/.github/workflows/release.yml \
     --deny-self-hosted-runners
   gh release verify v0.9.4 -R jpzk/opensidian   # the release itself (it is immutable)
   gh release verify-asset v0.9.4 opensidian-0.9.4-x86_64.rpm -R jpzk/opensidian   # each file is pinned by the release attestation

   v0.9.2 and earlier releases have no attestations.

Build from source

Tested 2026-10-03 on fresh Ubuntu 26.04 LTS and Fedora 44 with Rust 1.98.0 (build ~2.5 min on 4 cores, binary runs and renders on both).

1. System deps. Ubuntu/Debian:

   sudo apt install build-essential libssl-dev libwebkit2gtk-4.1-dev \
     libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev

   Fedora:

   sudo dnf install gcc gcc-c++ make openssl-devel webkit2gtk4.1-devel \
     gtk3-devel libappindicator-gtk3-devel librsvg2-devel

2. Rust, if you don't have it (distro rustc is often older than 1.98):

   curl --proto '=https' -sSf https://sh.rustup.rs | sh -s -- --default-toolchain 1.98.0
   . "$HOME/.cargo/env"

3. Build:

   git clone https://github.com/jpzk/opensidian && cd opensidian/src-tauri
   cargo build --release --locked   # -> target/release/opensidian

Nix

The repo ships a flake (Nix 2.4+). It pins nixpkgs unstable and builds with --locked against src-tauri/Cargo.lock, so the toolchain and every crate are pinned.

nix run .     # build and run
nix build .   # -> result/bin/opensidian, with the desktop file installed
nix develop   # dev shell: rust-analyzer, clippy, rustfmt,
              # clippy, rustfmt and all native deps; then:
              #   cd src-tauri && cargo test --locked

On NixOS, the spawn::tests::switch_alive_probe_reads_proc test fails: it hardcodes /bin/true, which does not exist there. The flock/landlock integration tests also need a wider sandbox than the Nix build sandbox grants, which is why the flake runs cargo test from the dev shell and not as a flake check.

Licence

GPL-3.0-or-later (LICENSE). Read THIRD-PARTY.md before redistributing.

Themes

Most Obsidian community themes work as they are. Ships with AnuPpuccin (default), Material Gruvbox, Minimal and Solarized, unmodified (THIRD-PARTY.md).

To add one, put its manifest.json and theme.css in <vault>/.obsidian/themes/<Name>/ (folder name = "name" in the manifest) and pick it in Settings ▸ Appearance ▸ Themes. CSS snippets go in .obsidian/snippets/. Both reload live. A broken theme shows greyed out with the reason, and the app stays on AnuPpuccin.

Community plugins

Off by default. Each vault starts in restricted mode: no community plugin code runs.

Turning it on. Open Settings ▸ Community plugins and switch Restricted mode off. The choice is per vault and is saved in ~/.opensidian.json, outside the vault, so a vault you open cannot turn its own plugins on.

What that means. With restricted mode off, the plugins you enable run code from the internet with your user's rights, the same as in Obsidian. They can run programs, open network connections and servers, send HTTP requests to any host, and open files and links with your system's default apps. Apart from the dialog before a program starts (below), there is no per-plugin permission prompt. Enable only plugins you trust.

Running programs. Each time a plugin starts a program, a native dialog names the program, its arguments, the folder and the plugin, and asks: Deny (the default), Allow once, or Always allow this program. Always is saved in ~/.opensidian.json for that vault, plugin and program, together with a sha256 of the plugin's main.js + manifest.json and of the program file, all read from disk by the app. If any of them changes, you are asked again. The sha256 is of the files on disk, not a proof of the code that is running: a plugin that rewrites its own files could put the approved bytes back before a spawn and reuse the grant. Only the dialog can add such a grant; Settings ▸ Community plugins ▸ Allowed programs lists them (an old one is marked outdated and never used) and has a Revoke button for each. Caveat: Always allow lets the plugin run that program again with ANY arguments, without asking. Arguments can be malicious (for example options that make the program run other commands, or a script an interpreter reads), and they are not checked again. Allow an interpreter or a shell (sh, python, node, ...) always only if you would let the plugin run anything.

Browse. Settings ▸ Community plugins ▸ Browse lists the community plugins. You can search, sort, and open a plugin to read its details and README. Install, Update and Uninstall download only from GitHub over HTTPS. The sha256 of every installed file is recorded. Installing does not enable a plugin; you enable it yourself. Copying a plugin folder into <vault>/.obsidian/plugins/ still works.

Secrets. Plugins that store secrets (API keys, tokens) use your system keyring through the Secret Service: gnome-keyring, KWallet or KeePassXC. Secrets are never written to a file. Without a running keyring, secret storage reports that it is unsupported and those plugins cannot save secrets.

Donate

Donation makes it possible!

bc1qzyh8c8kr8aylywqacsjwau6frzwjqt3cpa603w (BTC)

AI disclosure

opensidian was built predominantly with AI models. Nearly all of the code, the design docs, and this README were written by Claude (Anthropic's models, via Claude Code) working from prompts, reviews, and corrections by a single human maintainer. The human decided what to build and what the trust model must guarantee, read and pushed back on the output, and ran it; the models wrote most of the lines. Commit messages record the design rationale in the same way — many were drafted by the model and edited by the maintainer.