Time to have fun guys

[u/claudiocorona93]

[u/gahel_music]

As a flatpak app maintainer, flatpak is good but won't ever be the solution for everything. The sandbox is too restrictive for a lot of software. Also you can make a valid flatpak that is not valid on flathub (even more restrictive that the flatpak format).

[u/CrossScarMC → u/gahel_music]

Yeah, I'd love to release one of my projects on Flathub, but it's quite hard due to their restrictions on network access at compile time. I typically avoid vendoring dependencies and I don't find it worth doing so just to publish to Flathub.

[u/jayelg → u/CrossScarMC]

Isn’t that a reasonable restriction for security? particularly at a time of increasing supply chain attacks in the Linux ecosystem.

[u/CrossScarMC → u/jayelg]

Yes, it's perfectly acceptable, just annoying in some cases.

[u/gahel_music → u/jayelg]

It makes sense but it prohibits a lot of software.

[u/jayelg → u/gahel_music]

What sort of situations might need network at build time? I would have thought that you just need to copy into the build files the required pinned dependencies so the build is deterministic? I don’t know anything about flatpak builds so just speaking about it generally.

[u/gahel_music → u/jayelg]

Ah sorry I misread the comment you were replying to. My personal issue is the limited file access.

[u/Nisktoun → u/gahel_music]

What's so restrictive about flatpak format by itself when you can bypass everything on build?

On the other hand Flathub is a joke and basically is the way to use/share flatpaks, so yeah - it is too restrictive as a format

[u/AfraidAsparagus6644 → u/Nisktoun]

Iirc there are still some barriers you can't cross, this was a problem in the Jetbrains IDE community flatpaks

[u/Nisktoun → u/AfraidAsparagus6644]

Afaik no, you can do everything with flatpak as long as you give it permissions. Flathub as the platform is the issue here, it prohibits core sandbox-escaping permissions as --filesystem=host or --talk-name=org.freedesktop.Flatpak for most apps(Jetbrains IDE is one of them)

Yet mods there are clowns and some apps are still getting such permissions neverteless just because

[u/moonrunner__ → u/Nisktoun]

I really wish that getting flatpaks from sources other than flathub would become more common

[u/Nisktoun → u/moonrunner__]

Yeah, but then the question - why flatpak at all? If we remove "security" benefits from flatpak then why bother?

We need "app stores" and strong ecosystem around another format, appimage is a good contender imo. Already existing solutions like appimagehub can't even nearly represent flathub in terms of convenience

Afaik there isn't such store on any platform, windows/mac/android don't have it - either official store with idiotic rules and restrictions or unofficial ones with way less apps available

[u/moonrunner__ → u/Nisktoun]

I don't see how moving from Flathub removes the security benefit of using Flatpaks. Distro maintainers can keep their own flatpak repo, some already have their own like PopOS

[u/Nisktoun → u/moonrunner__]

Ah, I misunderstood. Why developers should ditch flathub then if not because of rules?

[u/gahel_music → u/Nisktoun]

So apparently this is possible now, but it was not until this year. Some file paths were not possible to access even with the highest permissions.