Why does Trisquel offer the flatpak package in its repos?
- Login o registrati per inviare commenti
Flatpak is available in Trisquel's repos:
apt policy flatpak
flatpak:
Installed: (none)
Candidate: 1.12.7-1
Version table:
1.12.7-1 500
500 https://mirror.math.princeton.edu/pub/trisquel-packages aramo/main amd64 Packages
Flatpak can't really install anything (to my knowledge) without using flathub, and flathub recommends non-free software if people visit the flathub website. I don't know if flathub recommends non-free software if it's used on the command line, but I'm thinking it might.
So does flatpak really qualify to be a Trisquel package?
I notice that Flatpak is also an available package on Guix and Parabola and I see it as a package on the PureOS mirrors, but it's not on Hyperbola. Just curious as to how this has been thought through recently, if anyone has any insight.
Oh my, I went through the whole saga, but was eventually rewarded when I reached the last note:
"flatpak now has an option to exclude poorly-licensed packages - im not sure exactly to what degree (search results, a conflict mechanism, what are the criteria for exclusion, etc), or if the filter can be compiled (hard-coded) in, or if it is simply a CLI option or trivial checkbox in some GUI (ie: easily over-ridden, probably not the default behavior, etc) - but maybe there is something hopeful in that - at least those folks are considering this to be a significant issue now - thats more than can be said of most of them" -- https://labs.parabola.nu/issues/1035#note-135.
I believe https://labs.parabola.nu/issues/1035#note-135 refers to "the Flatpak repo subsets that enable users to select only verified and/or FLOSS apps in the Flatpak CLI or their desktop’s app center UI", as announced on https://discourse.flathub.org/t/flathub-in-2023/3808
According to https://github.com/flatpak/flatpak/issues/5305#issuecomment-1474994479 :
Seeing / installing only verified, should be already possible, just add a remote with only that subset active.
The same certainly holds for FLOSS apps. If the free/proprietary classification is not proper on Flathub (is it?), talking to Flathub developers would help all users. If that fails for some reason, FSDG distributions could theoretically team up to host a repository, possibly under FSF's administration, as https://lists.nongnu.org/archive/html/gnu-linux-libre/2016-04/msg00116.html suggested. Generating and hosting a Flatpak repository with https://github.com/flatpak/flat-manager (that Flathub uses) looks quite easy, but the real work would be reviewing the applications.
https://flathub.org/apps/search has a checkbox to filter "Free/Libre Open Source" licenses. Anyway, Trisquel's acceptance of Flatpak does not depend on Flathub's website, but only on the aforementioned "the Flatpak CLI or the desktop’s app center UI". At least, that is my understanding.
>"https://flathub.org/apps/search has a checkbox to filter "Free/Libre Open Source" licenses"
Ahh that's interesting. It does give some questionable results, such as a whatsapp client someone built for GNU/Linux distros, chromium, some kind of GeForce gaming program ... However, that's good to know that the filter is available.
>"Anyway, Trisquel's acceptance of Flatpak does not depend on Flathub's website, but only on the aforementioned "the Flatpak CLI or the desktop’s app center UI". At least, that is my understanding."
If that's the case then it doesn't matter, Trisquel should keep offering it as some people need it.
Well, according to the FSDG it does matter:
"Nor should the distribution refer to third-party repositories that are not committed to only including free software; even if they only have free software today, that may not be true tomorrow" -- https://www.gnu.org/distros/free-system-distribution-guidelines.en.html.
I have a feeling that a checkbox system may not be up to requirements.
So is MB saying that flatpak is ok, because Trisquel does not refer to any specific flatpak repos but only to the flatpak client itself? Otherwise I'm confused again.
I have a feeling that a checkbox system may not be up to requirements.
Indeed. The clients in Trisquel's repository (not Flathub's website, that the clients should never mention) should only list free applications. If Flathub's free subset is considered "committed to only including free software", it looks like it is a matter of adding it (and only it) with that command:
$ flatpak remote-add --subset=floss flathub https://flathub.org/repo/flathub.flatpakrepo
The generated configuration file for the remote could then be part of the package Trisquel ships. At least, that is my understanding. I have not tried.
What you are describing here looks like the CLI version of a checkbox system: "simply a CLI option or trivial checkbox in some GUI". The repo-that-must-not-be-named is still not committed to anything, and hence fails the FSDG test. As things stand, either the FSDG would need a rewrite, or the "committed to only including free software" repo is still missing.
FSDG compliant distros seem to be going their own way on that topic, which includes several language specific (cargo, pip, etc.) and language agnostic (like flatpak) third-party package managers. At least, that is my understanding.
What you are describing here looks like the CLI version of a checkbox system: "simply a CLI option or trivial checkbox in some GUI".
Once the repository added, it is not a CLI option. It is a line in the configuration file of the repository. That file can be edited directly or via flatpak remote-modify. Isn't it enough? I mean one can add as well an APT repository with nonfree software editing /etc/apt/sources.list directly or via "Software & Updates".
The repo-that-must-not-be-named is still not committed to anything, and hence fails the FSDG test.
Well, Flathub's FLOSS subset is supposed to only include applications distributed under a free software license... but there are edge cases (end of this post).
To check that my understanding of the status quo, I installed the flatpak package in Trisquel 11's repository. Initially, no Flatpak repository is configured. That command outputs nothing:
$ flatpak remotes
As a consequence, I see little reason to ban flatpak from Trisquel's repository: it does not seem to steer users towards nonfree software.
I then executed the command I gave in my previous post:
$ flatpak remote-add --subset=floss flathub https://flathub.org/repo/flathub.flatpakrepo
Here is the file defining the repository and that the Trisquel package could provide by default, if that is deemed OK:
$ cat /var/lib/flatpak/repo/config
[core]
repo_version=1
mode=bare-user-only
min-free-space-size=500MB
[remote "flathub"]
url=https://dl.flathub.org/repo/
xa.title=Flathub
gpg-verify=true
gpg-verify-summary=true
xa.comment=Central repository of Flatpak applications
xa.description=Central repository of Flatpak applications
xa.icon=https://dl.flathub.org/repo/logo.svg
xa.homepage=https://flathub.org/
xa.subset=floss
xa.subset-is-set=true
Search results only include what is in Flathub's FLOSS subset. For instance, Google Chrome is not listed if I execute that:
$ flatpak search chrome
Name Description Application ID Version Branch Remotes
Chromium Web Br… The web browser from Chromium project org.chromium.Chromium 115.0.5790.102 stable flathub
ungoogled-chrom… A lightweight approach to removing Google web service depende… …Eloston.UngoogledChromium 115.0.5790.102 stable flathub
PhotoQt Image V… View and manage images org.photoqt.PhotoQt 3.3 stable flathub
OpenShot Video … An easy to use, quick to learn, and surprisingly powerful vid… org.openshot.OpenShot 3.1.1 stable flathub
Firestorm Viewer Client for accessing 3D virtual worlds …ormviewer.FirestormViewer 6.3.9.58205 stable flathub
BleachBit Cleans files to free disk space and to maintain privacy org.bleachbit.BleachBit v4.4.2 stable flathub
Joplin A free, open source note taking and to-do application, which … net.cozic.joplin_desktop 2.11.11 stable flathub
Google Play Mus… Run Google Play Music as a standalone desktop app …ymusicdesktopplayer.GPMDP 4.7.1 stable flathub
Gabut Download … Simple and Fast Download Manager ….github.gabutakut.gabutdm 2.1.6 stable flathub
Nook Desktop Nook is an application that plays Animal Crossing hourly them… camp.nook.nookdesktop 1.0.10-f1 stable flathub
Shortwave Écouter une radio internet de.haeckerfelix.Shortwave 3.2.0 stable flathub
However, as you can see, the FLOSS subset includes packages that are usually considered problematic by the FSDG standards. Chromium in particular. Distributions adhering to the FSDG could try to convince the Flathub project to change their acceptance criteria in the FLOSS subset or at least have another subset defined, probably named FSDG. That is certainly best for the freedoms of everybody, not only those of users of 100% free distributions. Otherwise, those distributions could share a new repository. It is better than each of them hosting its own.
I am a translator!
> I mean one can add as well an APT repository with nonfree software editing /etc/apt/sources.list directly or via "Software & Updates".
Yes but /etc/apt/sources.list is preinstalled with trisquel. After installing the flatpak package, what will one do? Search the web and go to http://www.flatpak.org that provides intructions to install the whole flathub and/or follow the link to flathub from that page.
At the very least, installing the flatpak trisquel package should setup the restriction on flathub automatically. Then, there is still a problem that the only working graphical interface is flathub website and this is where 99% users will go.
We would need a graphical interface set up with the right option. If one follows the instructions for ubuntu on https://www.flatpak.org, one gets gnome-software installed but it is not functional on trisquel.
> After installing the flatpak package, what will one do? Search the web and go to http://www.flatpak.org that provides intructions to install the whole flathub and/or follow the link to flathub from that page.
Actually, it's almost certain that a user installing flatpak has already learned about it from somewhere else, e.g. from flatpak.org.
Removing flatpak/pip/composer/npm/docker would be rather unlikely to protect anyone from installing nonfree stuff. It would however make a distro much less compatible with other distros and would cause trouble to users who know what they are doing.
If DFSG has some requirements in this regard, I believe it'd be wisest to interpret these as liberally as possible. If anything, one could try adding warnings — either ones that would be displayed by APT when installing such package manager or ones that would be displayed when using the package manager itself.
I sympathize with andyprough here. I once also wanted to see some consensus in this topic and posted about it on Parabola forums. IIRC, it went without response :(
I am a translator!
> Removing flatpak/pip/composer/npm/docker would be rather unlikely to protect anyone from installing nonfree stuff.
I actually think it does, it at least forces one to ask about them if one wants to install something that has an install procedure using them and one will get answers on what these tools are and what the problems with them are.
So far, I have avoided them all, except flatpak because it was in trisquel repository, but I actually stopped using any flatpak app for several reasons.
> It would however make a distro much less compatible with other distros and would cause trouble to users who know what they are doing.
That is another problem. Certainly, some things may not work without re-packaging some pieces but then it is up to the distro to do that. Trisquel does not have pip and still, I have never noticed any package not working properly due to that. I could even install python libraries normally installed by pip but that were packaged in trisquel.
The recommended course is still to use the deb packages from Trisquel repositories, so users have no need to check packages one by one. I believe this is the whole point of having FSDG compliant distros, and the reason why people are trying to sort out these third-party package manager issues.
> > Removing flatpak/pip/composer/npm/docker would be rather unlikely to protect anyone from installing nonfree stuff.
>
> I actually think it does, it at least forces one to ask about them if one wants to install something that has an install procedure using them and one will get answers on what these tools are and what the problems with them are.
I admit, you have a point here.
It seems I sometimes approach issues from the perspective of a years-long extensive GNU+Linux user.
> So far, I have avoided them all, except flatpak because it was in trisquel repository, but I actually stopped using any flatpak app for several reasons.
I see. It's different in my case — I've never relied on flatpak for my personal needs. I find it impractical to avoid PMs like composer, npm or pip, tho. The problem is, even some crucial pieces of software like GNU social, Nextcloud or Jitsi Meet rely on one of these. Whether I download a docker image with the software or a release tarball — I can be certain it has been created using one of those PMs.
In the specific case of npm, even if I'm using other people's instances of such tools, I'm still effectively running the code of multiple JS libraries from npm. And most likely nobody verifies that the minified code of these libraries corresponds to that in their git repos
At the very least, installing the flatpak trisquel package should setup the restriction on flathub automatically.
That would be adding the /var/lib/flatpak/repo/config file I showed to the package in Trisquel's repository.
If one follows the instructions for ubuntu on https://www.flatpak.org, one gets gnome-software installed but it is not functional on trisquel.
I have just installed gnome-software-plugin-flatpak, in Trisquel 11's repository. With the /var/lib/flatpak/repo/config file I showed, GNOME Software only shows applications in the FLOSS subset and I successfully installed one, which appeared in the menu. So, I am not sure what you mean by "not functional on trisquel". I am using Trisquel GNOME though, installed though tasksel. That may make a difference.
Maybe you did not restart the session after installing flatpak. Indeed, right after installing that package, the flatpak command was warning me that "the directories '/var/lib/flatpak/exports/share' '/home/banana/.local/share/flatpak/exports/share' are not in the search path set by the XDG_DATA_DIRS environment variable, so applications installed by Flatpak may not appear on your desktop until the session is restarted.". An apparently small technical issue that it would be good to fix.
I am a translator!
I rebooted since I installed gnome-software. In the explorer tab I see "Aucune donnée de l'application trouvée". In the "Installée" tab, I see the list of installed app. If I search with the name of an app in trisquel repository, nothing is found.
I have the mate edition of trisquel, maybe I am missing some package or some configuration?
> Well, Flathub's FLOSS subset is supposed to only include applications distributed under a free software license...
Surely, you are not deliberately conflating "supposed to" with "committed to"?
Besides, we hereby inform you that you are in breach of point #2 of the Community Guidelines: "Avoid certain misnomers and propaganda terms."
https://www.gnu.org/philosophy/words-to-avoid.html#FLOSS
"Supposed to" because I believe it is solely based on the license indicated by whoever uploads the application. That makes Chromium be in the FLOSS subset for instance.
Besides, we hereby inform you that you are in breach of point #2 of the Community Guidelines: "Avoid certain misnomers and propaganda terms."
https://www.gnu.org/philosophy/words-to-avoid.html#FLOSS
I would have named the subset "free" or "libre", if I were the one deciding. The subset was named "floss". If you use any other name when adding the repository, it will not work.
There is "verified_floss" too. Although valuable, the verification has nothing to do with the licensing, according to https://docs.flathub.org/docs/for-users/verification
> Otherwise, those distributions could share a new repository.
"I also read the original discussion on the FSDG mailing list that occurred about a month before this issue was open, in which RMS suggested that if the repositories themselves could not be convinced to distribute free software only, then the best solution would be to extract the licensing information from each of these package manager's repo indices, if possible, and import only the free packages into a new separate repo for each package manager - that, he also suggested could be hosted by the FSF, if volunteers could accomplish the work of automated filtering." -- https://labs.parabola.nu/issues/1035#note-14.
the best solution would be to extract the licensing information from each of these package manager's repo indices, if possible, and import only the free packages into a new separate repo
With Flathub, that "separate repo" would be exactly the FLOSS subset, as far as I understand.
A subset of free software packages extracted from the-repo-that-must-not-be-named could be imported into a new separate repo. This is what the quote says, and what I thought you were suggesting.
"Free software" should not be too difficult to define without resorting to third-party filters.
I tried combining
--subset=floss
and
--subset=verified
in different ways, but there doesn't appear to be any clear way of getting all freely licensed software that's all from verified flatpak package creators. One thing I dislike about Flatpak is the large number of packages that are created by random strangers who have no relationship to the project they are packaging. In that way Flatpak is like the Arch AUR, where most packages are uploaded by completely unknown people with unknown motivations.
The subset you want is named "verified_floss". That command would add it:
$ flatpak remote-add --subset=verified_floss flathub https://flathub.org/repo/flathub.flatpakrepo
One thing I dislike about Flatpak is the large number of packages that are created by random strangers who have no relationship to the project they are packaging.
That is what the verification is for.
Ahhh. Where did you find all these subset names? I hunted around and couldn't find a listing.
Use the source, Luke:
assert_eq!(vec!["verified", "floss", "verified_floss"], subsets);
https://raw.githubusercontent.com/flathub/flat-manager-hooks/main/src/cmd_publish.rs
Or stumble on that post: https://discourse.flathub.org/t/flathub-in-2023/3808/3
For inclusion in distributions respecting the FSDG, no way to query the subsets of a repository from the clients (I did not find any, at least) may actually be a good thing, since Flathub's "verified" subset includes proprietary software. If that feature gets implemented, I believe a separate repository will be required, hence additional technical work (maintaining that repository).
That works by the way. And if you want to switch between verified_floss and regular floss, you can use the 'remote-modify' command like this:
flatpak remote-modify --subset=floss flathub
and this to return to verified_floss:
flatpak remote-modify --subset=verified_floss flathub
For example, to try the flatpak version of ungoogled-chromium I have to be on the floss subset, but most of the time I would want to be on the verified_floss subset.
The ungoogled-chromium lead dev Eloston takes credit for the flatpak package on their github page, so I don't feel quite as uneasy about trying that unverified package.
I am a translator!
The response in https://trisquel.info/fr/forum/how-install-pythons-pip-trisquel#comment-171709 seems to apply to flatpak as well so I also find it surprising that trisquel has a flatpak package.
Aramo has python-pip:
I am a translator!
When I search for this package in nabia, it isn't there although it is in the unbuntu version from which nabia is derived. This looks like there was some action in nabia to exclude it but not in aramo.
There were several posts on this forum about this, e.g. https://trisquel.info/fr/forum/how-install-pythons-pip-trisquel so I wonder whether something changed so that it was not ok on nabia but it is ok on aramo?
Or is it a mistake in aramo?
The general question is already on the to-do list: https://gitlab.trisquel.org/trisquel/ubuntu-purge/-/issues/5. Someone may want to add Flatpak there, and see what happens.
I am ready to give time to create Librepak, but have no idea where to begin. It potentially being a chore to maintain is fine with me. Only, my knowledge on the topic currently stands on the thin side of things. Currently processing this: https://docs.flatpak.org/en/latest/repositories.html.
Before making users jump through hoops to use Flatpaks I hope distros are willing to add more programs to their repos. I only use Flathub because the Trisquel repo doesn't have everything I use.
I am a translator!
> Before making users jump through hoops to use Flatpaks
After looking up dictionaries, I guess you mean "before making it difficult for users to use flatpaks on trisquel", is that correct?
> I hope distros are willing to add more programs to their repos. I only use Flathub because the Trisquel repo doesn't have everything I use.
Probably we can't expect that from ubuntu, so that would need to be done in trisquel directly. I guess we need to list programs to add and someone to be willing to do the work. I wish I could help but feel a bit clueless now.
> "After looking up dictionaries, I guess you mean "before making it difficult for users to use flatpaks on trisquel", is that correct?"
Correct, that would be what I meant.
> "Probably we can't expect that from ubuntu, so that would need to be done in trisquel directly. I guess we need to list programs to add and someone to be willing to do the work. I wish I could help but feel a bit clueless now."
I am fine using Flatpak or other methods to use various FOSS programs as I know that Trisquel doesn't have infinite manpower to add all the software I want. My issue is that if Andy were to have his way and Flatpak is removed from Trisquel then it not only hurts those trying to run non free software but those that use it to run FOSS software such as myself.
>"My issue is that if Andy were to have his way and Flatpak is removed from Trisquel then it not only hurts those trying to run non free software but those that use it to run FOSS software such as myself."
I did not say I want it removed, only that I was curious about what the current decision-making is about flatpak by the FSF-approved distros.
Also, even if flatpak were to be removed from Trisquel's repo, it's not like you would be prevented from using it - flatpak clearly gives you a one-line command to install it using their own PPA on any Debian-based distro.
> it not only hurts those trying to run non free software
You are putting it upside down. Trisquel users are consciously and actively trying to avoid any non-free stuff. Users who do not care about that already have Debian, Ubuntu and the likes, plenty of choice in fact, and do not seem to have any problem finding those.
Trisquel is committed to the FSDG: "our community's resources --the forum, documentation, etc-- are for free software only. Please do not distribute, recommend, or support non-free software here." Flathub, on the other hand, is not committed to anything, which is why there is an on-going discussion about how to make flatpak compatible with the FSDG, so users of FSDG compliant distros, like you, can make good use of it without risking accidentally installing non-free software.
- Login o registrati per inviare commenti