Distributors entering Flatpakland [LWN.net]

Distributors entering Flatpakland

Posted Jul 11, 2022 11:07 UTC (Mon) by lunaryorn (guest, #111088)
In reply to: Distributors entering Flatpakland by LtWorf
Parent article: Distributors entering Flatpakland

Builds in the flathub infrastructure have no network access, as far as I know. The manifest must list all sources explicitly, and the builder downloads these prior to invoking any build script.

to post comments

Distributors entering Flatpakland

Posted Jul 11, 2022 13:32 UTC (Mon) by LtWorf (subscriber, #124958) [Link] (2 responses)

But can they be whatever blobs or have to be pre-approved in some way?

Distributors entering Flatpakland

Posted Jul 11, 2022 13:37 UTC (Mon) by mbunkus (subscriber, #87248) [Link]

Flatpak manifests contain both the download URL as well as a checksum to verify that the downloaded file matches the expected content. See the LibreOffice manifest[1] as an example.

However, you can also provide files alongside the manifest in the same git repo. See e.g. the MKVToolNix manifest[2] as an example.

[1] https://github.com/flathub/org.libreoffice.LibreOffice/bl...
[2] https://github.com/flathub/org.bunkus.mkvtoolnix-gui

Distributors entering Flatpakland

Posted Jul 11, 2022 19:56 UTC (Mon) by bartoc (guest, #124262) [Link]

Yes they can be "whatever blobs" but that's true of dpkg and rpm too. The enforcement is at a distro policy level, not part of the tool. Indeed Fedora's flatpak repos enforce a similar policy to their RPM repos. But flatpak is more lax.