Distributors entering Flatpakland [LWN.net]

Distributors entering Flatpakland

Posted Jul 8, 2022 17:04 UTC (Fri) by jafd (subscriber, #129642)
In reply to: Distributors entering Flatpakland by ebassi
Parent article: Distributors entering Flatpakland

Is it possible to verify that the flatpak contains what it claims to contain by taking the manifest and rebuilding the exact same flatpak from sources and then hosting that?

to post comments

Distributors entering Flatpakland

Posted Jul 8, 2022 18:46 UTC (Fri) by atnot (guest, #124910) [Link] (5 responses)

It would be, there seems to be a tool for it[1], but to my knowledge this is not currently enforced. However at least in the case of Flathub, all of the builds are performed on their infrastructure[2] so one can at least have reasonable confidence in the manifests being accurate. At least, as much or more so than certain distros[3] that just allow maintainers to upload random binaries they created on their laptops.

Of course, being confident in the package being an authentic result of the manifest doesn't help a whole lot if what that manifest does is install opaque blobs from the internet that may not be authentic versions of their sources, even if flatpak does at least enforce that downloads match a given sha256.

[1] https://github.com/zaclegarssure/flathub-rebuilder
[2] https://buildbot.flathub.org
[3] and large language package managers, and source code hosting websites

Distributors entering Flatpakland

Posted Jul 11, 2022 8:46 UTC (Mon) by LtWorf (subscriber, #124958) [Link] (4 responses)

Serious builds shouldn't have access to the internet.

That's how it works on Debian. Either the stuff is in the .tar file (or git repo) or needs to be in a .deb package. No downloading. That's important to be able to do reproducible builds.

Distributors entering Flatpakland

Posted Jul 11, 2022 11:07 UTC (Mon) by lunaryorn (guest, #111088) [Link] (3 responses)

Builds in the flathub infrastructure have no network access, as far as I know. The manifest must list all sources explicitly, and the builder downloads these prior to invoking any build script.

Distributors entering Flatpakland

Posted Jul 11, 2022 13:32 UTC (Mon) by LtWorf (subscriber, #124958) [Link] (2 responses)

But can they be whatever blobs or have to be pre-approved in some way?

Distributors entering Flatpakland

Posted Jul 11, 2022 13:37 UTC (Mon) by mbunkus (subscriber, #87248) [Link]

Flatpak manifests contain both the download URL as well as a checksum to verify that the downloaded file matches the expected content. See the LibreOffice manifest[1] as an example.

However, you can also provide files alongside the manifest in the same git repo. See e.g. the MKVToolNix manifest[2] as an example.

[1] https://github.com/flathub/org.libreoffice.LibreOffice/bl...
[2] https://github.com/flathub/org.bunkus.mkvtoolnix-gui

Distributors entering Flatpakland

Posted Jul 11, 2022 19:56 UTC (Mon) by bartoc (guest, #124262) [Link]

Yes they can be "whatever blobs" but that's true of dpkg and rpm too. The enforcement is at a distro policy level, not part of the tool. Indeed Fedora's flatpak repos enforce a similar policy to their RPM repos. But flatpak is more lax.