GNOME 46 puts Flatpaks front and center

Posted Mar 27, 2024 3:19 UTC (Wed) by dilinger (subscriber, #2867)
Parent article: GNOME 46 puts Flatpaks front and center

As Gnome slowly transitions towards encouraging users to install sandboxed apps from a repository that they control, it makes me wonder if Debian should still have Gnome as the default desktop. It's one thing to pull extensions (Gnome extensions, Cinnamon extensions, Firefox extensions, etc) that run inside an existing process from an upstream-controlled repository. It's completely another for software to be recommending downloading entire standalone programs that don't necessarily satisfy the DFSG *instead of* the same Debian-packaged programs. Feels like a discussion worth having..

GNOME 46 puts Flatpaks front and center

Posted Mar 27, 2024 3:54 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link] (18 responses)

I hate GNOME UI with a passion, but moving to sandboxed apps is one of the better moves. It's pretty clear by now that the "single repo" model just doesn't scale.

IMO, Debian should embrace this model and build a trusted Flatpak repo where app updates go through the same Debian process as regular package updates.

GNOME 46 puts Flatpaks front and center

Posted Mar 27, 2024 7:35 UTC (Wed) by rrolls (subscriber, #151126) [Link] (11 responses)

Please no.

I am a happy Debian MATE user.

GNOME imo is still as icky as it was when GNOME 3 came out and sent me back to Windows for YEARS.

And I don't want Flatpak anywhere near my devices.

Personally I think Debian are embarrassing themselves having GNOME as their default desktop, but I don't mind having to switch it to MATE in the installer. But I REALLY don't like the idea of having to install even one Flatpak to make a MATE system work.

To the Debian folk, you are doing absolutely brilliantly maintaining the apt/.deb system, and I am grateful. Please don't change.

GNOME 46 puts Flatpaks front and center

Posted Mar 27, 2024 7:47 UTC (Wed) by mjg59 (subscriber, #23239) [Link] (10 responses)

Could you explain why? I understand concerns around Flatpak being used to distribute proprietary packages, but there's nothing preventing configuration of the client to ignore those.

GNOME 46 puts Flatpaks front and center

Posted Mar 27, 2024 17:07 UTC (Wed) by smoogen (subscriber, #97) [Link] (3 responses)

My problems with flatpaks from flathub come down to a general level of 'been burnt too many times before' so need more things to establish basic trust.

0. How do I debug when things go wrong (application crashes, something writes over config files, etc?).
1. How do I reproduce that build? How was it built and how do I get the bits of the bits which built things
2. How do I get information on how to trust the build system and infrastructure?
o I trust Fedora because I spent too many years in its internals.
o I trust Debian because I have done a cursory audit of how Debian packages are built and how devs trust each other.
o RPM and deb have ways for me to verify things are built how and when they say they are.
3. How do I set up and run my own system if I really fall in love with flatpaks and need to take over because they aren't the cool kid anymore and various developers have moved on.

I expect that these and other questions which come up are answerable, but it is yet another system I need to know how to deal with when I am already embedded deeply in one and partially in another.

GNOME 46 puts Flatpaks front and center

Posted Mar 27, 2024 18:28 UTC (Wed) by swilmet (subscriber, #98424) [Link] (2 responses)

I'm not entirely familiar with how to build flatpaks, but I have some experience with it, and I know that if I dig into the docs I can answer almost all your questions more or less easily.

Once you have built a GUI program that can be run from a terminal on Linux, it's not that hard to get it nicely integrated into the various desktops, with some freedesktop.org specs to follow (the *.desktop file, icons, etc), AppStream.

Flatpak is not a freedesktop.org standard (even if its name was initially xdg-app), but it comes as a solution for packaging needs (usually done by upstream developers themselves). Nowadays we see new small apps packaged as Flatpak only (initially), this is much easier than creating a deb, rpm, plus whatever other formats required for other distros.

If you want your app to be available to a wide audience, and quickly (i.e., not waiting that each distro package it), formats like Flatpak, Snap, etc are a solution.

If it makes the Linux desktops more popular, bringing more developers, making the platform more attractive, than I'm all for it.

GNOME 46 puts Flatpaks front and center

Posted Mar 28, 2024 18:20 UTC (Thu) by dilinger (subscriber, #2867) [Link] (1 responses)

I didn't really mean to spur a pros/cons/passionate-feelings discussion about flatpak with my comment. I was merely pointing out the fact that third-party flatpaks aren't vetted by debian to be DFSG-compatible, and so it's not really appropriate for debian's default software to be encouraging installation of them.

Cyberax above asked about debian having a "trusted" flatpak repo, but that doesn't really make much sense due to the effort involved. Actually building things in debian is easy (so easy a computer can do it! 😃). The labor-intensive part is checking licenses, and making application integrate well with the rest of the distribution. Any trusted flatpak repo would likely need to have applications go through that same process (otherwise, why is it "trusted"?). At that point, you might as well throw it into a deb container format instead of flatpak. Or switch away from dpkg to flatpak.

I don't personally have strong feelings about flatpak either way; but much like, say, docker/podman images, I like to stick to sources that I trust. Maybe gnome's flatpak repo could become that for me personally, but for the debian project that would take some negotiation.

GNOME 46 puts Flatpaks front and center

Posted Mar 29, 2024 12:19 UTC (Fri) by swilmet (subscriber, #98424) [Link]

Some collaboration would be needed between Debian and the Flatpak world.

The DFSG-compatible information could be added to Flathub packages, and Debian could create a downstream filter for Flathub (the filter would be configurable, of course).

GNOME 46 puts Flatpaks front and center

Posted Mar 28, 2024 7:59 UTC (Thu) by LtWorf (subscriber, #124958) [Link] (5 responses)

Just 2 days ago a user came to IRC to ask for help because he'd downloaded something from flatpak and it didn't start.

I told him to install the regular .deb from the regular repository.

It might be a better user experience if things that are shipped by flatpak had some kind of automated test to at least check that it runs.

GNOME 46 puts Flatpaks front and center

Posted Mar 28, 2024 11:01 UTC (Thu) by zdzichu (subscriber, #17118) [Link] (4 responses)

So you did zero troubleshooting? Not very helpful.

GNOME 46 puts Flatpaks front and center

Posted Mar 28, 2024 11:18 UTC (Thu) by LtWorf (subscriber, #124958) [Link] (3 responses)

I don't even know how to report such a bug and to whom… At least I helped the person.

GNOME 46 puts Flatpaks front and center

Posted Mar 28, 2024 12:20 UTC (Thu) by zdzichu (subscriber, #17118) [Link] (2 responses)

You fixed one particular problem. Next time when they install a flatpak'd software, not available in the distro, and encounter similar problem, they will be at the starting point. Whereas troubleshooting and fixing the problem with first flatpak package would be better in the long term. Fishing rod, not fish.

GNOME 46 puts Flatpaks front and center

Posted Mar 28, 2024 13:23 UTC (Thu) by LtWorf (subscriber, #124958) [Link] (1 responses)

Or maybe they will never need it?

Or maybe they will need it and package it themselves, thus becoming contributor.

You are very critical of how I helped. Yet I don't recall you being there and helping more.

GNOME 46 puts Flatpaks front and center

Posted Mar 28, 2024 13:38 UTC (Thu) by zdzichu (subscriber, #17118) [Link]

That's true. I wasn't there and I did nothing. You helped that user run application he wanted to run.

GNOME 46 puts Flatpaks front and center

Posted Mar 27, 2024 13:25 UTC (Wed) by pizza (subscriber, #46) [Link]

> IMO, Debian should embrace this model and build a trusted Flatpak repo where app updates go through the same Debian process as regular package updates.

Fedora already does something along these lines, FWIW.

(Rather, it's more accurate to say that the flatpaks they produce are built using Fedora's existing RPMs, which already have to adhere to Fedora policies, like proper [license] review, complete corresponding offline source, no-internet-access-during-builds, etc...)

GNOME 46 puts Flatpaks front and center

Posted Mar 28, 2024 4:56 UTC (Thu) by ejona86 (subscriber, #43349) [Link] (3 responses)

I was interested in the sandboxing, but at present it still seems more like security theater. A substantial number of the permissions allow trivial escape from the sandbox and some permissions that allow escape or access to sensitive data aren't displayed to the user. The user is not given the proper information to accept an app's permissions when installing, and upgrades can add permissions pretty easily. The only thing the sandbox legitimately comes close to handling is reducing impact of vulnerable apps (e.g., "opening a malicous Office file"), but app permissions are so leaky, it is of questionable practical value today.

I dug into it earlier this month and recorded my findings in two blog posts.
https://ejona.ersoft.org/archive/2024/03/03/flatpak-perm-...

I do look forward to Pipewire webcam support to avoid --device=all, in that it is a step in the right direction and it will let some classes of apps have a useful sandbox. But overall the file handling clearly is not working, and thus there's really no sandbox except for outliers.

GNOME 46 puts Flatpaks front and center

Posted Mar 28, 2024 23:16 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link]

Yes, Flatpacks are not particularly secure right now. However, they are a good practice to guide developers towards containerized applications that can't read random directories. It also protects against accidental "rm -Rf ~/ .cache" typos.

GNOME 46 puts Flatpaks front and center

Posted Mar 29, 2024 10:57 UTC (Fri) by intelfx (subscriber, #130118) [Link] (1 responses)

> I was interested in the sandboxing, but at present it still seems more like security theater.

For better or worse, the free software ecosystem can't afford a "flag day". There is, by definition, no one who can place (and enforce!) such a demand on the entire ecosystem.

As such, it evolves in the only way it can: iteratively. What you call security theater is simply an iteration.

GNOME 46 puts Flatpaks front and center

Posted Mar 29, 2024 14:19 UTC (Fri) by ejona86 (subscriber, #43349) [Link]

In my post I mention the benefit of allowing applications to add restrictions as they adapt to the sandbox. But don't show that to the user. The theater is mostly the UI in how permissions are displayed (or not!) and upgraded. Only a highly technical user can determine if the permissions are safe (and can't do it from the UI), and who knows the state after an upgrade. You can't trust the sandbox; you can only trust the publisher and reviewer.

GNOME 46 puts Flatpaks front and center

Posted Mar 28, 2024 7:57 UTC (Thu) by LtWorf (subscriber, #124958) [Link]

firejail has existed for years.

There is no reason why you can't sandbox binaries that come from .deb files.

It's not done by default because it tends to break a number of things, or it's so lax that it's not very useful.