If there's one thing you can always count on in the Linux world it's that packaging can be a nightmare. The OBS Studio team are not happy with the Fedora folks due to Flatpak problems and threatened legal action.
And Fedora Flatpaks are universal, they work on any distros.
Flatpak by design allows you to install Flatpaks from multiple stores. The fact that snap only allows one store is a common criticism of snap.
Fedora Flatpaks were created because Fedora has strict guidelines for packages. They must be FOSS, they must not included patented software, and they need to be secure.
Flathub allows proprietary and patented software, so not all Flathub packages could be preinstalled. And if a Flathub package was preinstalled, it could add proprietary or patented bits without Fedora having a say.
Flathub packages are also allowed to use EOL runtimes and include vendored dependencies that have security issues. Fedora does not want this. Fedora Flatpaks are built entirely from Fedora RPMs so they get security updates from Fedora repos.
They work on other distros… if they work at all. If those “strict guidelines” are resulting in flatpaks like OBS and Bottles, which are broken and the devs have tried to get them to stop shipping, then I’ll pass on Fedora flatpaks.
I dont criticize Flatpaks for allowing alternative packaging sources. I criticize Fedora for sneakily (whether intentionally sneaky or not) setting their broken flatpak repo as the default, leading to a bunch of confusion by Fedora users that don’t know they’re actually using different, sometimes broken, packages from everyone else.
The uBlue downstreams of Fedora know this, and they have the decency to present the user with that information upon installation. So thankfully, their users don’t end up wasting their time with problems that Fedora introduced.
“strict guidelines” are resulting in flatpaks like OBS and Bottles, which are broken and the devs have tried to get them to stop shipping, then I’ll pass on Fedora flatpaks
That’s fine.
I criticize Fedora for sneakily (whether intentionally sneaky or not) setting their broken flatpak repo as the default
It’s not sneakily. Fedora Flatpaks do not have verified badges and in Gnome Software, they show “[Flatpak Icon] Fedora Linux” right under the install button.
Is this system perfect? No. For example, it stills shows “Mozilla Corporation”, but note that this issue also affects Flathub. That line is about the app creator, not publisher.
leading to a bunch of confusion by Fedora users that don’t know they’re actually using different, sometimes broken, packages from everyone else.
Most people get their packages from their distros repos. Arch, Linux Mint, Pop!_OS all default to distro repos. The latter two include Flathub, but still prefer debs by default. So most people are using unofficial packages by default that are different from what everyone else is using.
As for users feeling “tricked”? That’s a difficult thing to say. I would like to say that users should at least know something about the distro they are choosing (ie Ubuntu users should know about snap; Fedora/Debian users should know about their stances on FOSS, security, and patents; Arch users should know its a DIY distro). But I was once a new user and I remember using Ubuntu for months before learning that their packages aren’t official and about how their repo freezes work.
The situation could certainly be improved. Fedora could show a slide in Gnome’s Tour screen informing them about Fedora defaults to their own packages not supported by upstream and their stances on FOSS.
I don’t disagree with most of that, but none of what you said actually addresses the problem. The problem is that there are functionally two (notable) flatpak repositories, but one of those is going against the will of the upstream software devs and shipping broken software that they have asked them to stop packaging. And Fedora users are getting the broken flathub repository as the default, without really having reason to suspect that their “flathub store” would ever trick them into installing from a different source. The “verified” badge, especially the lack thereof, does not address that.
As for users feeling “tricked”? That’s a difficult thing to say. I would like to say that users should at least know something about the distro they are choosing (ie Ubuntu users should know about snap; Fedora/Debian users should know about their stances on FOSS, security, and patents; Arch users should know its a DIY distro).
You can RTFM someone all day, but if you actually want Linux to be adopted by more people, you need to reduce the anti-patterns. Snaps are generally known about because they are infamous for also breaking packages. And they’re still major footguns when people are recommending Ubuntu to people that are new to Linux, who are the least likely to know that their apt package installations are going to be installing differently-packaged software that has its own set of problems. If we get to a point where Flatpaks have a similar problem to Snaps, we’ve taken a wrong turn, and it will only hurt Linux adoption.
My biggest problem with Flatpak is that Flathub has all sorts of weird crap, and depending on your UI it’s not always easy to tell what’s official and what’s just from some rando. I don’t want a repo full of “unverified” packages to be a first-class citizen in my distro.
Distros can and should curate packages. That’s half the point of a distro.
And yes, the idea of packaging dependencies in their own isolated container per-app comes with real downsides: I can’t simply patch a library once at the system level.
I’m running a Fedora derivative and I wasn’t even aware of this option. I’m going to look into it now because it sounds better than Flathub.
And Fedora Flatpaks are universal, they work on any distros.
Flatpak by design allows you to install Flatpaks from multiple stores. The fact that snap only allows one store is a common criticism of snap.
Fedora Flatpaks were created because Fedora has strict guidelines for packages. They must be FOSS, they must not included patented software, and they need to be secure.
Flathub allows proprietary and patented software, so not all Flathub packages could be preinstalled. And if a Flathub package was preinstalled, it could add proprietary or patented bits without Fedora having a say.
Flathub packages are also allowed to use EOL runtimes and include vendored dependencies that have security issues. Fedora does not want this. Fedora Flatpaks are built entirely from Fedora RPMs so they get security updates from Fedora repos.
They work on other distros… if they work at all. If those “strict guidelines” are resulting in flatpaks like OBS and Bottles, which are broken and the devs have tried to get them to stop shipping, then I’ll pass on Fedora flatpaks.
I dont criticize Flatpaks for allowing alternative packaging sources. I criticize Fedora for sneakily (whether intentionally sneaky or not) setting their broken flatpak repo as the default, leading to a bunch of confusion by Fedora users that don’t know they’re actually using different, sometimes broken, packages from everyone else.
The uBlue downstreams of Fedora know this, and they have the decency to present the user with that information upon installation. So thankfully, their users don’t end up wasting their time with problems that Fedora introduced.
That’s fine.
It’s not sneakily. Fedora Flatpaks do not have verified badges and in Gnome Software, they show “[Flatpak Icon] Fedora Linux” right under the install button.
Is this system perfect? No. For example, it stills shows “Mozilla Corporation”, but note that this issue also affects Flathub. That line is about the app creator, not publisher.
Most people get their packages from their distros repos. Arch, Linux Mint, Pop!_OS all default to distro repos. The latter two include Flathub, but still prefer debs by default. So most people are using unofficial packages by default that are different from what everyone else is using.
As for users feeling “tricked”? That’s a difficult thing to say. I would like to say that users should at least know something about the distro they are choosing (ie Ubuntu users should know about snap; Fedora/Debian users should know about their stances on FOSS, security, and patents; Arch users should know its a DIY distro). But I was once a new user and I remember using Ubuntu for months before learning that their packages aren’t official and about how their repo freezes work.
The situation could certainly be improved. Fedora could show a slide in Gnome’s Tour screen informing them about Fedora defaults to their own packages not supported by upstream and their stances on FOSS.
I don’t disagree with most of that, but none of what you said actually addresses the problem. The problem is that there are functionally two (notable) flatpak repositories, but one of those is going against the will of the upstream software devs and shipping broken software that they have asked them to stop packaging. And Fedora users are getting the broken flathub repository as the default, without really having reason to suspect that their “flathub store” would ever trick them into installing from a different source. The “verified” badge, especially the lack thereof, does not address that.
You can RTFM someone all day, but if you actually want Linux to be adopted by more people, you need to reduce the anti-patterns. Snaps are generally known about because they are infamous for also breaking packages. And they’re still major footguns when people are recommending Ubuntu to people that are new to Linux, who are the least likely to know that their
aptpackage installations are going to be installing differently-packaged software that has its own set of problems. If we get to a point where Flatpaks have a similar problem to Snaps, we’ve taken a wrong turn, and it will only hurt Linux adoption.Honestly, that sounds great.
My biggest problem with Flatpak is that Flathub has all sorts of weird crap, and depending on your UI it’s not always easy to tell what’s official and what’s just from some rando. I don’t want a repo full of “unverified” packages to be a first-class citizen in my distro.
Distros can and should curate packages. That’s half the point of a distro.
And yes, the idea of packaging dependencies in their own isolated container per-app comes with real downsides: I can’t simply patch a library once at the system level.
I’m running a Fedora derivative and I wasn’t even aware of this option. I’m going to look into it now because it sounds better than Flathub.