Michael Catanzaro, one of the developers of the Epiphany web browser (GNOME Web), who is involved in GNOME and Fedora projects, suggested re-evaluating the use of the FlatHub catalog in Fedora Linux. In the atomic-updating edition of Fedora Workstation, it is proposed to use the FlatHub catalog by default for flatpak packages installed by users, while limiting its own flatpak repository to only the pre-installed packages.
Currently, Fedora offers its own flatpak repository by default, the contents of which are formed based on the rebuilding of rpm packages. Packages from FlatHub can only be downloaded by enabling the 'Enable Third-Party Repositories' option in the GNOME application manager after installation, but even in this case, packages from the Fedora repository have higher priority.
According to Michael, most users would prefer installing packages from the FlatHub catalog, compiled by the main application developers rather than by those maintaining Fedora (80% of discussion participants expressed support for using FlatHub). It is suggested that application developers are more familiar with the nuances of their projects and compile flatpak packages that work better and are better tested by the community. In contrast, the rpm packages maintained in Fedora show little interest in supporting flatpak package variants and do not pay sufficient attention to error reports for such packages, leading to the quality of flatpak packages from Fedora being lower than those from FlatHub from the main projects.
Many users are unaware that when installing a flatpak package through the Fedora application manager, it is installed not from FlatHub, as in other distributions, but from the Fedora repository, where the packages differ from those in FlatHub. This results in issues specific to packages from the Fedora repository being perceived as problems in the official packages from FlatHub, leading to complaints directed at the main developers instead of those maintaining Fedora. For example, the problematic flatpak package OBS Studio in Fedora, which was prioritized over the package from FlatHub, led to a conflict with the OBS Studio project in February.
The future of Fedora Workstation is envisioned as an atomically updatable distribution, so it is better not to delay the transition to FlatHub. The use of a proprietary Flatpak repository is driven by the need for building in a trusted environment. For packages in FlatHub, even when considering only verified packages for which the main projects are responsible, the builds are done in external infrastructures whose security may be questionable.
The advantages of maintaining a proprietary repository in Fedora include guarantees that the package is built from the declared source code and contains only components under open licenses approved for use by Fedora. Packages in the Fedora repository may also include patches available only for RPM packages in Fedora and not yet accepted into the main codebase of the projects.
Michael's proposal amounts to defaulting to support for installing packages from FlatHub, categorized as 'free software,' in the atomic edition of Fedora Workstation. The ability to install from FlatHub will apply only to packages installed by users through the GNOME Software application manager. All flatpak packages pre-installed by default will continue to be downloaded from Fedora's own repository, but for non-default packages, FlatHub will be suggested as the source for deployment.
Before transitioning to FlatHub, it is proposed to jointly implement capabilities for building packages in a trusted infrastructure within FlatHub and to engage in verification based on reproducible builds. Additionally, the issue of using outdated versions of Flatpak Runtime in packages, for which vulnerability fixes have already been discontinued, should be addressed. Currently, 994 out of 3438 (almost a third) verified packages from FlatHub use outdated Runtime. Security issues also arise from outdated internal dependencies included in the packages and the use of insufficient sandbox isolation measures (some developers disable protection modes).
In addition to Michael, Timothée Ravier also presented a similar proposal: Fedora 43 suggests continuing the supply of pre-installed flatpak packages from the Fedora repository, but adding a filter that allows the installation of selected verified applications from FlatHub. The advantages of this proposed solution include reducing confusion for users and developers of major projects (developers have to sort through error messages specific to Fedora flatpak packages, sent under the guise that they are included in the official flatpak package). This change will also reduce the load on maintainers and allow them to focus on providing fixes for major projects and testing the default pre-installed Flatpak packages.
Source: opennet.ru
