Flatpak Post-1.0 Will Focus On Infrastructure Work

[dkasak]

Please stop this "money" bs... I am as much as a community member as many of us here and I did contribute my part over the decades using Linux. And yes. They do force me to use flatpaks. I see this happening and I foresee this coming. That is the main goal and main idea behind flatpaks anyways. Otherwise the developers wouldn't spent time in creating it.

Now I tell you why I believe that this is going to happen. I'm on Linux since... around 1996-1997 that time... I basicly do know how the creators of flatpak, systemd, pulseaudio etc. "think" and even more scarefully "act" because they all have one thing in common. They are formerly working on GNOME. the agressive marketing and the reality that was delivered afterwards.

Of course they are free to develop and invent whatever they want. But I fear (and I do have reasons for that), that they yet start another agressive marketing putting this kind of technology down the throaths of people. They already started by abusing the "security" nonsense... But we had that kind of conversation yesterday in the other thread here on Phoronix.

Principiis obsta sero medicina paratur

Wow, this is conspiracy theory territory. What flatpak apps are you forced to use? How was this force applied? What is this aggressive marketing you speak of? How do you think they'll put "this kind of technology down the throaths of people"? What was it you meant by "started by abusing the security nonsense", and do you have an example of this?

R U OK?

[blackiwid]

Typical american get off my lawn complaining here, mixed with european maybe german enviromentalism, so if you need to update your harddisk after 20 years hell breaks loose.

I had problems understanding the shitstorm about systemd, but at least it got a standart which is hard to get around. While this solution is only a addon technology and maybe some distros will replace their complete package system with it. But that will stay the minority so I don't see any harm.

But People use these days some alternative installers, if its the python-installer for flexget where I had many dependency problems in the end under fedora for some reasons. If it's docker for maybe nextcloud because nixos doesn't provide a package that you can easily install and run.

But mostly its for that commercial crap, and if you have to install for others some proprietary cray I am much more comfortable if that is at least sandboxed.

Most distros major point of existence is their own package format, take Archlinux as example, what would be the reason for existence of that distribution if you take away their package manager?

Same with nixos, btw if you wanna see a package managers that eats all your harddisk try to use nixos, but therefor you can boot old versions of the system or revert upgrades.

which should be on application-level also easier with flatpack I guess? because no dependency hell.

it's just one more option, today if you have no package for your distro you have big problems either have to start compiling or waste on your end much time and risk later breakage if you setup your stuff with workarounds and loose probably upgradability.

Also if some developers don't need to waste time for some packaging it frees a lot of developer time that can be used for other things.

I think it will grow naturally there is no need to have pure flatpak or pure traditional systems, so they will use flatpak where it makes sense and the advantages outweigh the disadvantages and use traditional model where the work overhead is small enough but the advantages of that model overweight the sandbox.

Opensource developers tend to now how they use their time in a effective good way, and if somebody really disagrees with the developers decition as example to only release his application as flatpak, if you are not the only person on the planet that thinks that way people then do the normal packages.

I just find it funny cause we don't come from a world were you can get everything with one distributions package manager, most fail on all the language specific packages you can install over pip and co, or commercial apps, also steam adresses the same problem.

There is no alternative to a mixed package system, that does not mean that if you only use a desktop and or only opensource software that you can get maybe with 1 2 distros get away of using only their package manager, but for most people that is not the case.

If I have the choice using nixos for servers with a docker nextcloud instance or having to use fedora or another major distribution instead because they have usable maintanable nextcloud packages I'd rather use docker.

And I probably would even use nextcloud docker images in that distries, too. Because back in the owncloud days I used this distribution packages and upgrades were a pain in the ass. One reason to delay the upgrade of my htpc was that it would break the nextcloud installation and I had to manually do then some work to make the upgrade of the data itself happen, because upgrading the software itself was never enough you had to update the database too, which not always worked flawless and then you had to search the forum how to fix stuff.

Sure Docker / server packages is a bit different than desktop stuff but you also fear such stuff breaking if you upgrade your distro so not one central package system where you have to upgrade everything at once makes upgrades likely less stressful and easy on that level too.

It will probably mostly be targeted to the proprietary world, there you have nearly exclusivly big applications anyway like steam games and so on. For such systems you need much diskspace anyway. I don't see how that could cause serious harm to the linux environment but I see some use cases where it might help, so go for it.

And btw LTS distros have a big fanbase and people get tired of upgrading their whole distribution every 6 months just because they want a never version of libreoffice or firefox, for these users that are not full-time hobbyist admins, its a great option so they can use new stuffs and don't upgrade their distro for 5 years. Some people are very busy.

[F.Ultra]

Now, there's also the problem with distro packages, I have to wait for maintainers to make packages for my favorite programs, sometimes some dependencies are broken (specially when dealing with smaller distros), and I can't install rpm/deb offline. If I have to download an app from the web, I have to choose between different formats, and to keep them updated I have to add repositories, a user shoudn't have to know what repositories are or what package format their distro uses. Windows has all al that sorted out: installers with resonable size, usually a single format (.msi also works everytime) and they're easy to use.

You won't get updates with the Windows model though so the Windows model should be compared with you downloading the RPM or DEB from the website directly, and choosing the format should be done by the website via either javascript or looking at the user-agent (or how they now do it, web design is not my area of expertise) like some sites do.

Adding external repositories can be done via the exakt same way since you can create DEB:s and RPM:s that do the necessary steps, it's just that few have gone that extra mile. Technically there is nothing stopping a vendor from having a single click download button for end users that would #1 install a repository and #2 install the package itself from said repository.

[Raploz]

You won't get updates with the Windows model though so the Windows model should be compared with you downloading the RPM or DEB from the website directly,

Well, under Windows plenty of programs update themselves automatically (web browsers come to mind), they don't need repositories to work.

...and choosing the format should be done by the website via either javascript or looking at the user-agent (or how they now do it, web design is not my area of expertise) like some sites do.
Adding external repositories can be done via the exakt same way since you can create DEB:s and RPM:s that do the necessary steps, it's just that few have gone that extra mile. Technically there is nothing stopping a vendor from having a single click download button for end users that would #1 install a repository and #2 install the package itself from said repository.

About websites choosing the correct package that's not usual. A month ago I went to the Opera website to download it, there was a big download button that almost made me download a .deb package, it's funny because they do offer a .rpm package (well hidden in their website), but they assume you need a .deb, again, the end user shoudn't have to know the difference, everything should just work. On Google Chrome download page you also have to choose what package format you want, totally not user friendly.

About the automatic repository addition, that's something developers should definitively implement if they want their programs to be easy to install, unfortunately, that's not what happens most of the time.

[oiaohm]

Well, under Windows plenty of programs update themselves automatically (web browsers come to mind), they don't need repositories to work.

Not exactly true. If you look at firefox and chrome and other windows programs that auto update you will see a private repository they access to get current version.

So self updating applications be it windows or linux or OS X you have to create a repository for something as a program to access and so you have a pattern to store older versions in case newer don't work.

Please plenty of windows programs have their repository access program for updates as part of the main program. This does cause problems when you want to have users as like guest users and then require administrators to create secondary systems to deploy updates.

[Weasel]

Not exactly true. If you look at firefox and chrome and other windows programs that auto update you will see a private repository they access to get current version.

So self updating applications be it windows or linux or OS X you have to create a repository for something as a program to access and so you have a pattern to store older versions in case newer don't work.

No you don't. All you need is a version check and a download link to the installer. Distributed by the application vendor, not by a 3rd party, which is the point. You're arguing semantics again.

[andrei_me]

This is one of the main reasons things like Ubuntu's PPA, OpenSUSE OBS, Arch AIUR and probably other similar "official community package hosting/compiling services" exist if the distro is big enough.

AFAIU, that is exactly what the guys of Flatpak sees as an issue.

To them, the 3rd party developer should only care about it's app, it shouldn't need to worry in managing all this repositories so their users are able to install the latest versions of the app.

So besides the security concern,s base API for developing apps for linux and blablabla, the Flatpak tries to solve this repository issue as a means to distribute the app

[starshipeleven]

AFAIU, that is exactly what the guys of Flatpak sees as an issue.

Yeah, the hard part of "managing a repository" is setting up the compilation and packaging toolchain of their app for all distros they want to support.

Because for each distro they have to make sure that the application compiles and runs fine with the distro's provided libraries and environment. Which is extremely time-consuming once you factor the number of "major" Linux distros you might want to target, and usually done by the distro users themselves and not the application developer.

What Flatpack does here is dealing with the dependency issue. They provide stable dependencies (the "runtimes") so you don't have to care about distro X, Y or Z actually having the libraries you need at the version you want. You have an application that needs KDE frameworks 5.9? You define a dependency for the KDE frameworks 5.9 runtime and make sure your application compiles and runs with that flatpak-provided stable dependency.

Then what you build will work fine on any distro, regardless of what is the KDE frameworks installed in the distro or what is the KDE framewors required by other flatpacked application.

Will it use more space as each KDE framework (or GNOME) runtime is around 250MB? Yeah it does, but it does offset a whole lot of work for developers and package maintainers, and reduces substantially any breakage for the users.

[starshipeleven]

No you don't. All you need is a version check and a download link to the installer. Distributed by the application vendor, not by a 3rd party, which is the point. You're arguing semantics again.

Many applications ship different stuff depending on language for example, Firefox and Chrome do that, they don't come with ALL supported languages by default.

So yeah they have a crude "repository" for localized applications, or for the language packs for the very least.

Firefox (maybe Chrome too?) also can download patches, aka updates that don't reinstall the whole application, which again need some form of repository.

I've never seen application updater software smart enough to actually re-install an older version if something goes wrong, but they a repository for old versions is extremely common, so people can still access and install them if needed (licensed software do this all the time, as you might have a license for version X and didn't feel like paying again for the same software with a slightly different interface and a higher version number, so you still need to be able to download the software at the version you have the license for).

[oiaohm]

No you don't. All you need is a version check and a download link to the installer. Distributed by the application vendor, not by a 3rd party, which is the point. You're arguing semantics again.

That is not how bigger applications work. When you are paying for bandwidth delta updates reduce the amount everyone updating has to update. Delta updates normally see a repository system.

Ostree in flatpak is a system to implement delta updates. flatpak does not forbid application vendor running their own repository and distribute themselves. Neither does most package management. Just look at google chrome they run their own deb repositories.

Many applications ship different stuff depending on language for example, Firefox and Chrome do that, they don't come with ALL supported languages by default.

So yeah they have a crude "repository" for localized applications, or for the language packs for the very least.

Firefox (maybe Chrome too?) also can download patches, aka updates that don't reinstall the whole application, which again need some form of repository.

I've never seen application updater software smart enough to actually re-install an older version if something goes wrong, but they a repository for old versions is extremely common, so people can still access and install them if needed (licensed software do this all the time, as you might have a license for version X and didn't feel like paying again for the same software with a slightly different interface and a higher version number, so you still need to be able to download the software at the version you have the license for).

Exactly. Its not like you can get rid of the old versions instantly. The only one I know is smart enough to kind of re-install if update fails is ostree used under flatpak basically a part update is automatic roll back. ostree used as os image will keep old image until after the first successful reboot using the new image so new image fails to run a failure boot is automatic return to old version of software. So flatpak in theory could be smarter by delaying removable of old version until after new version works the framework is there to allow it to come smarter than flatpak currently is.