Fedora threatened with legal action from OBS Studio due to their Flatpak packaging
-
I prefer flatpaks that work.
-
And Fedora Flatpaks are universal, they work on any distros.
Flatpak by design allows you to install Flatpaks from multiple stores. The fact that snap only allows one store is a common criticism of snap.
Fedora Flatpaks were created because Fedora has strict guidelines for packages. They must be FOSS, they must not included patented software, and they need to be secure.
Flathub allows proprietary and patented software, so not all Flathub packages could be preinstalled. And if a Flathub package was preinstalled, it could add proprietary or patented bits without Fedora having a say.
Flathub packages are also allowed to use EOL runtimes and include vendored dependencies that have security issues. Fedora does not want this. Fedora Flatpaks are built entirely from Fedora RPMs so they get security updates from Fedora repos.
-
And that’s a perfectly fine position to have. I get most of my apps from Flathub.
I also think that Fedora Flatpaks should be allowed to exist. And most of them work without issues. They just don’t get as much testing as Flathub since the user base is smaller.
-
Just gonna leave this here...
-
That honestly doesn't sound like a bad mission, but it seems like there's a couple other requirements they should impose on their mission and then there wouldn't be any controversy.
They should require that their package works as well as the upstream, and, in the even that it doesn't, they need to be very blatant and open that this is a downstream package, and support for it will only be provided by Fedora Flatpaks, and that you may have better results with the official packages.
The primary issues in this case is that it doesn't work, and it's not been clear to users who to ask for help.
-
Why don't you like fedora flatpaks?
Among other reasons, Fedora ensure that apps get a flatpak. Imagine there was no official flatpak, fedora would've made one. Just like fedora ensures that there are native ways to install it via dnf. On atomic distros, you want to use flatpaks very often. Hence it makes sense to package apps via flatpak.
Fedora ensures that there is not additional code in the app kind of like fdroid on phones.
Anyone can make flatpaks, not just the main dev.
-
Confidentally incorrect.
Flathub has nothing to do with this
-
Honestly, that sounds great.
My biggest problem with Flatpak is that Flathub has all sorts of weird crap, and depending on your UI it's not always easy to tell what's official and what's just from some rando. I don't want a repo full of "unverified" packages to be a first-class citizen in my distro.
Distros can and should curate packages. That's half the point of a distro.
And yes, the idea of packaging dependencies in their own isolated container per-app comes with real downsides: I can't simply patch a library once at the system level.
I'm running a Fedora derivative and I wasn't even aware of this option. I'm going to look into it now because it sounds better than Flathub.
-
I can confirm, I really missed the opportunity
-
You can edit the title...
-
And that's the #1 reason to use Mint over Ubuntu!
Snaps make a little more sense in servers since you can package CLI stuff in snaps, but not in flatpaks. For GUI apps, it's "fine" but it doesn't solve new problems, and the way Canonical has migrated apt packages to snaps is aggressive and error-prone.
-
They work on other distros... if they work at all. If those "strict guidelines" are resulting in flatpaks like OBS and Bottles, which are broken and the devs have tried to get them to stop shipping, then I'll pass on Fedora flatpaks.
I dont criticize Flatpaks for allowing alternative packaging sources. I criticize Fedora for sneakily (whether intentionally sneaky or not) setting their broken flatpak repo as the default, leading to a bunch of confusion by Fedora user that don't know they're actually using different, sometimes broken, packages from everyone else.
The uBlue downstreams of Fedora know this, and they have the decency to preaent the user with that information upon installation. So thankfully, their users don't end up wasting their time with problems that Fedora introduced.
-
I answered most of this in the other thread, but I am aware that anyone can make flatpaks. What I meant is that flatpaks were supposed to make it easier for devs to get their software to end users by allowing them to not have to worry about distro-specific packaging requirements or formats.
But when someone else takes it upon themselves to make broken flatpaks, ones that you've requested they stop doing, now they're making things worse for everyone involved and should be considered a hostile fork and treated as such.
-
As someone who works with multiple projects who have had to beg and plead to get broken packages taken down, I can confidently assert that it is.
They've gotten too popular too fast, and dozens of projects have had similar experiences to OBS.
Some issues we've dealth with in the past year:
- unmaintained community package which included libraries that made our package vulnerable and was tripping up static scanners
- one package unpublished due to a complaint from a completely unrelated person
- spammed and suspect versions of our packages being published with shady blobs that aren't part of our project
There's plenty more. There just isn't any kind of moderation, and there needs to be. Regardless of their original intent, it's now become too big to just let go. Similar things have happened over the years with almost every maintained public package repository: gems, npm, pypi...etc.
Now it's time for the Flathub folks to step up and do some moderation to prevent worse things from happening. The minimum they could do is add a flag for official packages that are confirmed to be from the proper sources, but that requires a bit of effort on their part.
-
This isn't about Flathub. The problem is that Fedora has their own repo and the packages there take priority over the properly-maintained ones in FlatHub, per OBS.
Not that what you've mentioned is wrong, but in this comment section that's a different topic than what we're discussing.
-
It reads as if fedora wanted to created a broke package. As if it was on purpose to annoy everyone. Do you think that was their intention?
-
IT'S OVER, MAN. YOU HAVE TO LET IT GO!!!!
-
Is there any merit to the claim OBS is using a end-of-life (EOL) and that this is a very bad thing for security?
-
The OBS and Bottles packages have been broken for a long time. Long enough that both upstream projects asked them to stop many months ago. They don't get to pretend it was a mistake.
-
“strict guidelines” are resulting in flatpaks like OBS and Bottles, which are broken and the devs have tried to get them to stop shipping, then I’ll pass on Fedora flatpaks
That's fine.
I criticize Fedora for sneakily (whether intentionally sneaky or not) setting their broken flatpak repo as the default
It's not sneakily. Fedora Flatpaks do not have verified badges and in Gnome Software, they show "[Flatpak Icon] Fedora Linux" right under the install button.
Is this system perfect? No. For example, it stills shows "Mozilla Corporation", but note that this issue also affects Flathub. That line is about the app creator, not publisher.
leading to a bunch of confusion by Fedora users that don’t know they’re actually using different, sometimes broken, packages from everyone else.
Most people get their packages from their distros repos. Arch, Linux Mint, Pop!_OS all default to distro repos. The latter two include Flathub, but still prefer debs by default. So most people are using unofficial packages by default that are different from what everyone else is using.
As for users feeling "tricked"? That's a difficult thing to say. I would like to say that users should at least know something about the distro they are choosing (ie Ubuntu users should know about snap; Fedora/Debian users should know about their stances on FOSS, security, and patents; Arch users should know its a DIY distro). But I was once a new user and I remember using Ubuntu for months before learning that their packages aren't official and about how their repo freezes work.
The situation could certainly be improved. Fedora could show a slide in Gnome's Tour screen informing them about Fedora defaults to their own packages not supported by upstream and their stances on FOSS.
