Can the runtime be upgraded? [LWN.net]

Can the runtime be upgraded?

Posted Jul 9, 2022 13:14 UTC (Sat) by epa (subscriber, #39769)
In reply to: Distributors entering Flatpakland by bluca
Parent article: Distributors entering Flatpakland

So, suppose a security hole is found in a commonly used Flatpak runtime — the version of zlib it includes is vulnerable, say. Is it just a case of distributing a new runtime, installing it to replace the old one, and all Flatpaks that use it are now fixed?

to post comments

Can the runtime be upgraded?

Posted Jul 9, 2022 14:42 UTC (Sat) by smcv (subscriber, #53363) [Link]

Yes, if apps Foo and Bar use (for example) the freedesktop.org Platform 21.08 runtime, then upgrading the fdo Platform 21.08 runtime is usually enough to give both Foo and Bar a fixed copy of zlib.

Similarly, if Foo uses the GNOME runtime and Bar uses the KDE runtime, and both the GNOME and KDE runtimes are based on fdo Platform 21.08, then having the maintainers of the GNOME and KDE runtimes trigger an automatic rebuild against fdo Platform 21.08 is usually enough to give both Foo and Bar a fixed zlib.

The only time this would not be enough is if Foo and Bar are statically linked to zlib, or build and bundle their own zlib in /app/lib, or otherwise have their own private copy of zlib instead of using the runtime's. Traditional distro packages have the same limitation, of course.

Can the runtime be upgraded?

Posted Jul 9, 2022 14:45 UTC (Sat) by dbnichol (subscriber, #39622) [Link]

Yes (once the application is restarted). Almost all (or possibly even all) of the actively used runtimes are based on the Freedesktop runtime - https://gitlab.com/freedesktop-sdk/freedesktop-sdk. Once it's fixed there and the other runtimes based on it are rebuilt, the vulnerability can be updated in all applications.