Nice
Good to see one of the two big packaging hubs do something against malware
this post was submitted on 28 Mar 2024
395 points (98.3% liked)
Linux
48298 readers
349 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
How does that Help against Malware?
Because if you search Firefox and see a badge that says verified, you can be confident that it was Mozilla that packaged it and added it to FlatHub as opposed to some random scammer.
You can't just upload a App to Flathub. Everythng is reviewed.
Things get missed. And they don't get reviewed in every update, just the original upload.
Apt has done this forever
This is a good step but I still feel like it's pretty obscure where a package is actually coming from. "by Google" or for the Steam package "by Valve" is really confusing and makes it sounds like it's coming directly from the company. Unverified tells the user to pay attention but there is no hover over to say what it actually means.
Wait… so the author displayed in “by ” is the supposed author of the software, not the one that put it on the store? That’s insane! Also sounds like you’d be open to massive liability since the reputation of the software author will be damaged if somebody publishes malware under their name.
It should be:
- Developed by:
- Uploaded by:
Also maaany packages direct to issuetrackers of projects not supporting that flatpak.
If someone knows where that flathub metadata is stored I would love to know, as the manifest is not it. I would like to fix those to link to their own bugtrackers
Traditional GNU/Linux distributions (as well as F-Droid) are not "app stores" even though they are superficially similar. Traditional distributions are maintained and curated by the community, and serve the interests of users first and software developers second, whereas an "app store" has minimal curation and serves the needs of software developers first and users second.
I point this out because there's an annoying meme that traditional distributions are obsoleted by the "app store" model. I don't think that's the case. "Verification" is essential for an app store but pointless for a distribution.
So all of them?
Would be nice if FlatHub actually supported cryptographic verification of apps..
Flathubs repository’s is GPG signed.
Nope. Link me to the docs that say this.
The GPG key is literally in the repo file https://dl.flathub.org/repo/flathub.flatpakrepo
Lol that's not for signing the packages
There is no such thing as a “package”. It is a repository of binary data with references to data in it (ala git). The whole repo and all data is gpg signed.
Your claim that package payloads are signed is bullshit. Back it up by citing your sources
> ostree show flathub:runtime/org.kde.Platform/x86_64/6.6
commit a7443e846cf67d007fcecda5c9dc27844001cfb8929064395cfc25c6d71d9474
Parent: 23107550082daf3b2892a4a0db2543838578ca882340a756b988bc5c1614540c
ContentChecksum: 607ba9475d32a24c51509bc7919f5a93d401f8f7198c30ad93ad74051d966c41
Date: 2024-01-30 13:55:08 +0000
build of org.kde.Sdk, Tue Jan 30 11:23:00 UTC 2024 (5998d2f3ef21414d14f066ab91fa44e5aef65b90)
Name: org.kde.Platform
Arch: x86_64
Branch: 6.6
Built with: Flatpak 1.14.4
Found 1 signature:
Signature made Tue 30 Jan 2024 12:21:18 PM CST using RSA key ID 562702E9E3ED7EE8
Good signature from "Flathub Repo Signing Key <[email protected]>"
Primary key ID 4184DD4D907A7CAE
Key expires Mon 14 Jun 2027 08:19:40 AM CDT
Primary key expires Mon 14 Jun 2027 08:18:56 AM CDT
And what happens if I mitm you and you get something unsigned? Does it ignore it and proceed?
This is why in asking for the docs that describe the security
GPG errors are fatal unless you manually configure the repo to ignore them with an obscure command.
Please link to the docs
great, when appimage hub begin doing this
What app is that GUI from?
This screenshot is from the Flathub website. The only good GUI for Flatpaks...
The only good GUI for Flatpaks…
Ain't that the truth. I don't know why KDE Discover is so sluggish when it comes to Flatpak, it takes me like 10+ seconds to load the landing page and see the popular apps.
And several minutes to update a 10MB app...
what? there's something wrong with your internet
Nah, it's Discover that's shit. Flatpak's CLI works fine.
Likewise with Gnome in my experience. I've been using the CLI but am now realizing I might be missing out on some important information by doing that
It's definitely faster than it used to be. But yeah, searching for app updates is still more sluggish than through the terminal, at least on Fedora Workstation.
Gnome Software is pretty similar. KDE Discover way worse.