Distributors entering Flatpakland [LWN.net]

Distributors entering Flatpakland

Posted Jul 8, 2022 15:47 UTC (Fri) by IanKelling (subscriber, #89418)
Parent article: Distributors entering Flatpakland

apt-get source. There is no equivalent for flatpak that I know of. Seems like a huge regression I do not want.

to post comments

Distributors entering Flatpakland

Posted Jul 8, 2022 15:59 UTC (Fri) by ebassi (subscriber, #54855) [Link] (23 responses)

Every application using Flatpak includes the full manifest of its dependencies, including the source archive (tarball with checksum or git repository plus commit id, plus the location of eventual patches) inside the archive itself, as a machine parseable file. That also applies to the manifest of each run time.

It would be entirely possible today to write a simple script that took that manifest and downloaded every single dependency into a specific location.

Distributors entering Flatpakland

Posted Jul 8, 2022 17:04 UTC (Fri) by jafd (subscriber, #129642) [Link] (6 responses)

Is it possible to verify that the flatpak contains what it claims to contain by taking the manifest and rebuilding the exact same flatpak from sources and then hosting that?

Distributors entering Flatpakland

Posted Jul 8, 2022 18:46 UTC (Fri) by atnot (guest, #124910) [Link] (5 responses)

It would be, there seems to be a tool for it[1], but to my knowledge this is not currently enforced. However at least in the case of Flathub, all of the builds are performed on their infrastructure[2] so one can at least have reasonable confidence in the manifests being accurate. At least, as much or more so than certain distros[3] that just allow maintainers to upload random binaries they created on their laptops.

Of course, being confident in the package being an authentic result of the manifest doesn't help a whole lot if what that manifest does is install opaque blobs from the internet that may not be authentic versions of their sources, even if flatpak does at least enforce that downloads match a given sha256.

[1] https://github.com/zaclegarssure/flathub-rebuilder
[2] https://buildbot.flathub.org
[3] and large language package managers, and source code hosting websites

Distributors entering Flatpakland

Posted Jul 11, 2022 8:46 UTC (Mon) by LtWorf (subscriber, #124958) [Link] (4 responses)

Serious builds shouldn't have access to the internet.

That's how it works on Debian. Either the stuff is in the .tar file (or git repo) or needs to be in a .deb package. No downloading. That's important to be able to do reproducible builds.

Distributors entering Flatpakland

Posted Jul 11, 2022 11:07 UTC (Mon) by lunaryorn (guest, #111088) [Link] (3 responses)

Builds in the flathub infrastructure have no network access, as far as I know. The manifest must list all sources explicitly, and the builder downloads these prior to invoking any build script.

Distributors entering Flatpakland

Posted Jul 11, 2022 13:32 UTC (Mon) by LtWorf (subscriber, #124958) [Link] (2 responses)

But can they be whatever blobs or have to be pre-approved in some way?

Distributors entering Flatpakland

Posted Jul 11, 2022 13:37 UTC (Mon) by mbunkus (subscriber, #87248) [Link]

Flatpak manifests contain both the download URL as well as a checksum to verify that the downloaded file matches the expected content. See the LibreOffice manifest[1] as an example.

However, you can also provide files alongside the manifest in the same git repo. See e.g. the MKVToolNix manifest[2] as an example.

[1] https://github.com/flathub/org.libreoffice.LibreOffice/bl...
[2] https://github.com/flathub/org.bunkus.mkvtoolnix-gui

Distributors entering Flatpakland

Posted Jul 11, 2022 19:56 UTC (Mon) by bartoc (guest, #124262) [Link]

Yes they can be "whatever blobs" but that's true of dpkg and rpm too. The enforcement is at a distro policy level, not part of the tool. Indeed Fedora's flatpak repos enforce a similar policy to their RPM repos. But flatpak is more lax.

Distributors entering Flatpakland

Posted Jul 8, 2022 17:30 UTC (Fri) by IanKelling (subscriber, #89418) [Link] (14 responses)

I want to know, for any flatpak package, how to download the source, and build a possibly modified version. Until I know that, I don't trust flatpaks and I don't like them.

https://docs.flatpak.org seems to be entirely about creating and building an app locally and publishing the binary, but nothing about about how to download existing app and build that.

The equivalent documentation for apt is something like this: https://wiki.debian.org/BuildingTutorial which includes apt-get source PACKAGE, and building from that.

Distributors entering Flatpakland

Posted Jul 8, 2022 17:55 UTC (Fri) by IanKelling (subscriber, #89418) [Link] (9 responses)

Oh, also, even if I have that, flathub lists proprietary apps right next to free software apps without any distinction. That is very bad. The search and listing functionality do not allow me to find only free software apps. l read the little license field, and if you are a new user, how are you going to know that a little unexplained license acronym like "MIT" or "GPL-3.0" means it is free software? It is sending the message, the license is a small unimportant detail, things that are way more important are: it's functionality category, the editor's choice, it's "popularity", because you can find apps through that, but not if it has a free license.

Also, the license information is much worse. In debian based distros, I can easily see the license of every dependency. There is more complete licensing info in /usr/share/doc/PACKAGE/copyright. And I know that someone has put some time and effort into checking them.

Distributors entering Flatpakland

Posted Jul 8, 2022 23:38 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (8 responses)

In my opinion:

* Flathub should allow you to filter by FOSS-only.
* Anyone who is realistically going to exercise any of the four freedoms (other than freedom 0) is also in a position to figure out what "GPL" or "MIT" mean.
* It would be nice if they had a link to the license or something like that.
* Many end users do not care to exercise the other three freedoms, and may see a big "this is proprietary" banner (or, worse, an outright segregation of proprietary software into a separate results page by default) as a nuisance.
* The modern web has done a very effective job of training users to obstinately ignore any component of the page that is not related to their current task, on the assumption that it's probably trying to sell them something or harvest their email address. You can put up a banner, but they won't read it.
* Annoying end users is not an effective means of advocacy. They didn't write the proprietary software, nor are they personally responsible for its market dominance.

Distributors entering Flatpakland

Posted Jul 9, 2022 11:08 UTC (Sat) by khim (subscriber, #9252) [Link] (6 responses)

Indeed. We live in a world where the majority of users wouldn't be able to excercise these all-too-essential freedoms anyway: they are not developers themselves and they don't have money to pay the developers.

We have to accept that. It's just how life is.

But that means that things like licensing and even the distinction between free software or proprietary shouldn't be shoved into the new user face.

If Flathub doesn't allow one to filter FOSS-only packages then it's bad, I suppose: some people do want to avoid proprietary apps and while they are in the minority (and would always be in minority) they deserve adequate treatment. As long as they not try to impose their will on the majority, that is.

Distributors entering Flatpakland

Posted Jul 10, 2022 4:48 UTC (Sun) by IanKelling (subscriber, #89418) [Link] (5 responses)

> Indeed. We live in a world where the majority of users wouldn't be able to excercise these all-too-essential freedoms anyway: they are not developers themselves and they don't have money to pay the developers.

That isn't right: the majority of students in the US are learning to
code. A large fraction of people will know some basics. Practical
software freedom is useful and important.

I've shown to 10-12 year old kids that they can open a terminal with
just one command to download and two to build, can get sources to any
package in the entire trisquel repo, make a small change, and run the
result. They are amazed and inspired. Someone in these comments told me
a command to download flathub sources from, but it doesn't seem to be
documented anywhere, and I don't know how to build them. So, I still
consider this a major regression from free packages in debian based
distros and I'm going to avoid it in general.

Distributors entering Flatpakland

Posted Jul 10, 2022 13:55 UTC (Sun) by Wol (subscriber, #4433) [Link] (4 responses)

> > Indeed. We live in a world where the majority of users wouldn't be able to excercise these all-too-essential freedoms anyway: they are not developers themselves and they don't have money to pay the developers.

> That isn't right: the majority of students in the US are learning to code. A large fraction of people will know some basics. Practical software freedom is useful and important.

I'm sorry, but you're living in cloud cuckoo land ...

As a professional software developer, I all too often find myself in the position of being unable to exercise those freedoms. As I said, I would like to have Reveal Codes in LO, but I lack both the skills, and money, to be able to do anything about it.

Just because it's a mandatory part of education, it doesn't mean students are even *capable* of learning, and even if they are capable, doesn't mean they have the *desire* (which is massively important!).

You can have the brightest students in the world, and if they want to be musicians, or artists, or lawyers, it's a pretty safe bet they won't be able to code for toffee BECAUSE THEY HAVE NO INTEREST IN IT! (Or their skills will be crap because it's a necessary but unwelcome requirement. I see that daily in my job.)

RMS by all accounts was a software prodigy. Mozart was a music prodigy. Other people are prodigies elsewhere. The majority of people are either below average, or tend to be prodigies hopeless at fields outside their expertise. "Jack of all trades, master of none" springs to mind. Or "Master of one, hopeless elsewhere". The freedoms are great for professional coders or software prodigies, useless for other people.

Cheers,
Wol

Distributors entering Flatpakland

Posted Jul 11, 2022 8:50 UTC (Mon) by LtWorf (subscriber, #124958) [Link] (3 responses)

You don't need to be a "software prodigy" to change a couple of things here and there. And on Debian systems that's really really easy.

apt-get build-dep xxx
apt-get source xxx
[do your thing]
dpkg-buildpackage

You don't have to figure out the specific way that package builds, the compiler options, the configure options, the dependencies… it's all done.

Distributors entering Flatpakland

Posted Jul 11, 2022 10:13 UTC (Mon) by Wol (subscriber, #4433) [Link] (2 responses)

> You don't need to be a "software prodigy" to change a couple of things here and there. And on Debian systems that's really really easy.

> apt-get build-dep xxx
> apt-get source xxx
> [do your thing]
> dpkg-buildpackage

You're missing a very important point.

For the typical man on the Clapham Omnibus, they don't have difficulty following instructions, they have problems with "[do your thing]".

Let me list the languages I know - FORTRAN IV, Fortran 77, C, Forth, DataBasic, Perl, VBA ... (to dramatically varying abilities - 77, C, VBA, DataBasic I've seriously used ... and I've probably missed a few ...) and still I have major trouble even trying to UNDERSTAND the code base of various projects I want to get involved in - lilypond, LO, ScarletDME. I can build it easy enough - FFS my main distro is Gentoo!

If I, a seriously bright programmer, have trouble then your average guy isn't going to stand a hope. Yes, a lot of my problem is lack of time, but then that's true of average bloke, who DOESN'T WANT TO KNOW unless he's forced to.

You forget we are a self-selecting minority. To 99% of the people out there, all this is an irrelevance, a distraction, something they would much rather not know about even when they are forced to care ...

Cheers,
Wol

Distributors entering Flatpakland

Posted Jul 11, 2022 10:36 UTC (Mon) by ldearquer (guest, #137451) [Link] (1 responses)

Some software is way too big for doing casual modifications. Such is the case of LO -you will spend hours only to figure out where stuff is located (some documentation is provided for this though)
However many other packages are more manageable. My wacom was triggering a zoom event by accident on some drawing program, which was pretty annoying, and there was no config option to disable this behavior. But it was on a debian based distro, so getting the sources, searching "wheel", commenting out the wheel event and rebuilding the package was quite straight forward.

Distributors entering Flatpakland

Posted Jul 11, 2022 16:05 UTC (Mon) by IanKelling (subscriber, #89418) [Link]

+1 I agree

Distributors entering Flatpakland

Posted Jul 11, 2022 20:18 UTC (Mon) by bartoc (guest, #124262) [Link]

* The filtering by license should be improved, it appears how fedora was doing it was a bit hacky
* yep, and I think flathub lists SPDX identifiers too, so you can distinguish between GPL-2.0-only and GPL-2.0 or GPL-2.0 only or GPL-3.0 only and so forth.
* Yeah, many users might, but on the other hand they are using a free platform with (extremely importantly) a free "appstore" and distribution mechanism.
* Yep, and perhaps many non-technical people will want to use a free platform because they want to escape from having the platform try and sell them things, especially things sold by the platform vendor.
* I agree, and I think flathub and the gnome-software experience do a pretty decent job, the banner is a pretty simple red indicator in the "app details"

The other nice thing is that flatpak will prevent non-free apps from screwing up the system by incorrectly attempting to do applocal deployment of their runtime dependencies. It's really rather hard to do this correctly on linux (and can be nearly _impossible_ if you end up with libraries that load tightly coupled plugins and are too enthusiastic in their search for them). Let's just say if I still had to support Matlab installations I would absolutely make a flatpak and distribute it that way.

I suppose making bundling in this way easy does make it easier to distribute proprietary apps (after all, proprietary rpm/dpkg repos are .... not usually worthwhile or reliable)

Distributors entering Flatpakland

Posted Jul 9, 2022 10:57 UTC (Sat) by khim (subscriber, #9252) [Link] (3 responses)

> I want to know, for any flatpak package, how to download the source, and build a possibly modified version.

You don't have that web deb, you don't have that with rpm (if you claim otherwise then show me how I can download sources for the official deb/rpm builds of Chrome), why do you think flatpak would provide that?

Most developers don't want to bother with publishing their sources thus any format which makes it impossible is DOA.

Distributors entering Flatpakland

Posted Jul 10, 2022 4:35 UTC (Sun) by IanKelling (subscriber, #89418) [Link] (1 responses)

> Most developers don't want to bother with publishing their sources thus any format which makes it impossible is DOA.

Most packages in GNU/Linux distros are free software and the source code is published.

Distributors entering Flatpakland

Posted Jul 12, 2022 9:31 UTC (Tue) by khim (subscriber, #9252) [Link]

And only tiny minority of software ends up in GNU/Linux distros.

Of course software there would be rebuildable! It's like trying to see how many people are using Internet via an Internet-based medium.

But even the majority of deb and rpm packages (delivered by various commercial providers and/or parts of lesser-known distributions) come without source.

You just try to live in the imaginary world where these don't exist.

Distributors entering Flatpakland

Posted Jul 18, 2022 9:47 UTC (Mon) by ras (subscriber, #33059) [Link]

> You don't have that web deb,

Odd. I do this often: "apt-get source xxx ; debuild xxx". In fact I do it often I have a little shell script that takes the URL of a Debian .dsc (source package), and builds it from source.

Yes, Chrome is a little different. It's near impossible to build from source. I'm struggle to understand anybody who favours the open source model could think that is a good thing, that should be facilitated by the open source movement. If your happy with that, why not just download the binary from Google directly and bypass all the inconvenience open source imposes? That's effectively what happens for google-chrome on Debian now. If you like running google-chrome on Debian it works very well.

Distributors entering Flatpakland

Posted Jul 9, 2022 12:25 UTC (Sat) by MickeyDance (guest, #112575) [Link]

You just agreed with what was said. No tool curently exists.

Distributors entering Flatpakland

Posted Jul 8, 2022 19:29 UTC (Fri) by nedrichards (guest, #23295) [Link] (3 responses)

There are certainly some things that address this problem, and have been from the very beginning (not a surprise given how many Very Debian people have been involved over the years). I'd be lying if I said this was super polished though, improvements are very welcome from motivated individuals.

> flatpak install flathub org.gnome.gedit.Sources

gets you a flatpak extension with the sources used in the build (certainly available for all the apps on flathub) when using flatpak-builder you call --bundle-sources to create one of these extensions. Also as ebassi says you get the manifest as well which should be 'pretty reproducible' if you just built that yourself.

Distributors entering Flatpakland

Posted Jul 8, 2022 20:42 UTC (Fri) by IanKelling (subscriber, #89418) [Link] (2 responses)

> > flatpak install flathub org.gnome.gedit.Sources

>gets you a flatpak extension with the sources used in the >build (certainly available for all the apps on flathub)

That is great. I will actually try flathub at some point then. Is this documented somewhere? If not, do you know an appropriate place for it?

Distributors entering Flatpakland

Posted Jul 10, 2022 20:07 UTC (Sun) by nedrichards (guest, #23295) [Link] (1 responses)

That's a great question - certainly this could be better explained on docs.flatpak.org - currently on flathub it'd be on the wiki but there's a whole big new website and flow being constructed due to some funding from the GNOME Foundation - a part of which is the ability to filter by free software status in the repos (again, it may need a bit more work to plumb that all the way through the whole experience). https://discourse.flathub.org/t/seeking-contractors-for-w... has more on this.

I'll continue having a think if there's anywhere easier to send patches.

Distributors entering Flatpakland

Posted Jul 11, 2022 15:45 UTC (Mon) by IanKelling (subscriber, #89418) [Link]

It is not documented on the wiki as far as I can tell. In the main docs, there is a mention of a builder option which would create a sources package. That doesn't really help anyone know that those packages exist on flathub.

"the wiki" I assume you mean is: git clone https://github.com/flathub/flathub.wiki.git