Flatpak's Flathub Seeing Infrastructure Improvements, Finally Support For Beta Releases

[IreMinMon]

I fail to see the problem as packagers from Linux distros, even trustworthy distros like Debian, are still random people from around the world. Sure, they might have a reputation and an about page, but nothing stops them from releasing harmful packages into the distros.

A flawed system can't possibly get any better you say?

[IreMinMon]

But i don't need flatpak if i need to compile myself. My point it that you cant trust any packages from some anonymous person or a platform that don't check the uploaders. Flatpack is kinda ok but only if official packages are provided or by a trustworthy person.

And i don't want anyone to force to disclose his name or private information to the public, but just to the platform where he or her upload packages that everyone installs easily.

Its like the PPAs or other third party repository's. at the end you give an unknown person full access to your system and not even the platform validate the uploader.

I think guys at flathub will have to address this eventually. Does anyone here think Steam would let anyone publish random shit on their platform without even requiring publishers to reveal their identities and sign some kind of contract with the platform?
If you screw the customer on Android Market or whatever the Apple equivalent is, you get sued to hell.
If you screw the customer on Alibaba, you get sent to Gulag.
If you screw the customer on Flathub, well what happens then?

If I was flathub I wouldn't want to be known as the platform with the least amount of consumer protection. No serious developer will publish their software on a platform deemed unsafe for their customers.

[Nille]

I fail to see the problem as packagers from Linux distros, even trustworthy distros like Debian, are still random people from around the world. Sure, they might have a reputation and an about page, but nothing stops them from releasing harmful packages into the distros.

But everyone that has write access to the Debian repository's is knows by Debian and there leaders or by a responsible person. The same is with Ubuntu, Fedora, etc.

[starshipeleven]

Its different if we talk about bugs or malicious software. The difference in the major Linux distributions that not everyone can Upload a package. So there is a kind of validation there.

They have sane submission rules,

https://github.com/flathub/flathub/wiki/App-Requirements

and as most github projects they need a member to approve the pull request, see one of the applications approved here
(yes, most of the posts are from a build bot, look for the github users with the "member" badge as they are the project admins with commit access.

https://github.com/flathub/flathub/pull/823

https://github.com/flathub/flathub/pull/823

But i don't need flatpak if i need to compile myself.

That's the only way to really check that a distro isn't shipping malware too. Rebuild the package and check the checksum of your package vs the package in the distro repos. Flatpak packages just like distro packages are specifically made to be reproducible, from the same source you get exactly the same result.

My point it that you cant trust any packages from some anonymous person or a platform that don't check the uploaders. Flatpack is kinda ok but only if official packages are provided or by a trustworthy person.

I really don't think even distros care that much about their package maintainers. Whoever shows up to be a maintainer of a package is usually good enough. They don't do extensive background checks or even make sure that he is actually a real person or anything.

That's one of the reasons why "source packages" exist. They allow users to ckeck that the maintainer isn't a fraud.

And i don't want anyone to force to disclose his name or private information to the public, but just to the platform where he or her upload packages that everyone installs easily.

This is completely irrelevant as I said, as it's random civilians all over the world, even with full name and personal information you would be hard-pressed to actually make sure he isn't lying and even when he is not it would be useless for suing him unless you like to sue someone in random countries overseas and have some seriously fat stacks to burn in this endeavor.

Its like the PPAs or other third party repository's. at the end you give an unknown person full access to your system and not even the platform validate the uploader.

No it's not like a third party repo if that's what you mean. Any new application or application update needs to be approved and committed to the project's app repo by a project admin.

Applications without a maintainer (when the maintainer quit) are also tagged as orphan by admins too https://github.com/flathub/org.mozil...b5901f65d53717

[starshipeleven]

But everyone that has write access to the Debian repository's is knows by Debian and there leaders or by a responsible person. The same is with Ubuntu, Fedora, etc.

There is no liability provided, so no "responsible" if anything goes wrong in distros.

It would only be a PR hit

[starshipeleven]

A flawed system can't possibly get any better you say?

Unless they are paid by the distro, this is probably too much to ask for from volunteers.

[Vistaus]

But everyone that has write access to the Debian repository's is knows by Debian and there leaders or by a responsible person. The same is with Ubuntu, Fedora, etc.

The guy who recently shot people in lllinois was also known by his leaders, didn't stop him from shooting though. My point is that they have write access and while they are known, it still doesn't stop them from doing anything they want if they really wanted to harm Debian.

[Anvil]

What? Flathub doesn't package beta software. In fact, when I requested the spotify flatpak to be updated to the latest beta, like Solus does with its regular 3rd party package, I got told by the Flathub maintainers that they only package stable packages.

im afraid ya wrong, Flathub will now be able to Package Beta software. im sure i read there on phoronix or on planet gnome website.https://blogs.gnome.org/alexl/2019/0...-flathub-land/

[Vistaus]

im afraid ya wrong, Flathub will now be able to Package Beta software. im sure i read there on phoronix or on planet gnome website.https://blogs.gnome.org/alexl/2019/0...-flathub-land/

Oh, well that's something that was announced very recently. Didn't know that, thanks.