Distributing through Flathub is insecure?

jerm · March 14, 2024, 1:42pm

FeatherWallet creator shared his findings:

dumpster · March 14, 2024, 2:55pm

While I appreciate their concerns about signing and auditing limitations and runtime bloat, it strikes me as plainly biased that they characterize debian as being good because its popularity increases scrutiny, while flatpak is bad because its popularity makes it an enticing target.

Nostradamus · March 15, 2024, 3:20pm

To play devil’s advocate, the big difference there is Debian having single source of true vs Flatpak having everyone who is willing as source

Viper · March 16, 2024, 12:18am

Maybe that’s why bitwarden doesn’t have flatpak

So now im gonna change all my flatpaks to appimages

Gonna use this to keep them updated

As per Distrotube video

Good old privacy, never ending journey.

anon43985288 · March 16, 2024, 4:59am

Appimages are worse than Flatpaks from this topic’s standpoint. There’s no signed package verification whatsoever.

jerm · March 16, 2024, 11:22am

The problem is with Flathub, not flatpaks, they are good.

rollsicecream · March 16, 2024, 11:26am

Well, there’s one, but it is unofficial.

anon43985288 · March 16, 2024, 11:36am

Well the flatpak just downloads the official deb and ships that. The poc for a flaptak is there, Bitwarden have just not taken ownership of the flathub app yet.

github.com/bitwarden/clients

Oficialise/Take control of the Flathub package

opened 08:25PM - 03 Nov 23 UTC

EuriNaiz

desktop feature-request

### Steps To Reproduce Recently Flatpak package got broken and the response of …the issues reports where basically ["is not our problem and use appimage, now the issue is closed"](https://github.com/bitwarden/clients/issues/6785#issuecomment-1792518198). So, I propose a solution: take control of the flatpak package and make it official. Flathub use to have apps maintained by the community, but when the original dev ask the ownership, they just give it to him/her. Why? Is better to have direct distribution. Recently [Discord got verified](https://www.omgubuntu.co.uk/2023/10/discord-flatpak-now-verified-flathub) and now the flathub package is official, so, the more sensible is to do the same as they. Flatpak is the only way to install apps on Fedora Silverblue, Suse MicroOS, Endless OS, is the 1st way on VanillaOS and is so used on other distros, so, is necessary a flatpak package taking in count that flathub is the official linux store and the future of linux apps is flatpak. Flatpaks are universal and work the same way in all linux distros, Even on ChromeOS!. Is really easy to push packages to flathub, and even can be automatised with CI/CD, and the packages are updates automatically. So, not having a flatpak package for time reasons is just an excuse. ### Expected Result An official Flatpak package ### Actual Result An unofficial package with problems. ### Screenshots or Videos _No response_ ### Additional Context _No response_ ### Operating System Linux ### Operating System Version All Linux Distros, Universal Package ### Installation method Other ### Build Version Lastest ### Issue Tracking Info - [X] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

anonymous159 · March 16, 2024, 12:22pm

why???

jerm · December 14, 2024, 4:31pm

github.com/flathub/flathub

Indicate on flathub.org Whether a Flatpak is Built from Source or Binary During Build Process on Flathub

opened 11:30AM - 18 Oct 24 UTC

closed 11:39AM - 18 Oct 24 UTC

adrelanos

### Problem Statement: Flathub currently lacks transparency in showing whether …a Flatpak application is built from source code or if prebuilt binaries are used during the build process. Many users who care about software freedom, security, and reproducibility prefer source-built applications over precompiled binaries. While an application may be open-source, it could still be downloaded as a binary from upstream, bypassing the benefits of building from source. This distinction is especially important for those who value transparency and the integrity of software distribution. ### Importance of Source-built Applications: Reproducible builds, which are becoming a critical goal in software distribution, hold more value if the software is compiled from source, rather than being downloaded as a precompiled binary. While Flathub may eventually accomplish the goal of reproducible builds, its value would be diminished if many of the Flatpaks available are simply redistributed binaries from upstream. Transparency in this area would empower users to trust the builds more and make informed decisions. ### Comparison with Other Ecosystems: In the Debian community, the idea of removing embedded copies of code or binaries from upstream source packages is strongly encouraged to improve security and clarity in open-source software development. As the [Debian Wiki on Embedded Copies](https://wiki.debian.org/EmbeddedCopies) explains: > “Embedded copies (of code, data, fonts or other things) should be removed from the upstream VCS and source tarballs. Upstream might want to only embed the copies in the binary packages they distribute.” This concept is highly relevant to Flatpak's goals as well, as users expect the same level of scrutiny and transparency. ### Proposed Solution: 1. **Metadata Update**: Introduce a new field in the app metadata indicating whether a Flatpak is built from source or downloaded as a binary during the build process. 2. **UI Integration**: Display this information prominently on the Flathub website for each application, alongside existing metadata such as developer and license details. 3. **CLI Support**: Extend the Flatpak CLI to display this information when querying app details, such as using `flatpak info`. 4. **Automated Detection**: As part of the build process, have the build system automatically detect and log whether the build was from source or binary and update the metadata accordingly. 5. **Subset**: `verified_floss_source` ### Benefits: - **Increased Transparency**: Users can make more informed choices about the software they install, especially if they prioritize open-source and source-built applications. - **Support for Reproducible Builds**: Providing transparency into whether a build is from source or binary would add credibility to reproducible builds efforts on Flathub. - **Trust and Security**: Source-built applications reduce the risk of hidden vulnerabilities or proprietary code being introduced during the build process, improving trust in the ecosystem.

But at the moment doing this at scale in an automated fashion is not possible for us.

flathub locked and limited conversation to collaborators

Topic		Replies	Views
PSA (good news): Bitwarden flatpak on flathub is now listed as official General article	0	218	November 4, 2024
Proton bridge flatpak vs official? General	2	269	September 30, 2024
Should I trust Flathub with important applications? Questions software	16	1386	September 21, 2023
Are all Linux app stores a mess? Questions	2	485	March 21, 2024
Are community maintained packages as safe as developer-provided ones? Questions	19	1569	October 15, 2023

Distributing through Flathub is insecure?

Related topics