Linux

7242 readers

381 users here now

A community for everything relating to the GNU/Linux operating system

Also check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 2 years ago

MODERATORS

Ategon@programming.dev

anzo@programming.dev

dwraf_of_ignorance@programming.dev

186

Fedora threatened with legal action from OBS Studio due to their Flatpak packaging (www.gamingonlinux.com)

submitted 2 months ago by cm0002@lemmy.world to c/linux@programming.dev

31 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] ArsonButCute@lemmy.dbzer0.com 15 points 2 months ago (1 children)

Source?

[+] jagged_circle@feddit.nl 0 points 2 months ago* (last edited 2 months ago) (1 children)

[removed by mod]

[–] MissingInteger@lemm.ee 10 points 2 months ago (1 children)

flatpak build-sign, is what I can find in the documentation.

[+] jagged_circle@feddit.nl -9 points 2 months ago* (last edited 2 months ago) (1 children)

[removed by mod]

[–] MissingInteger@lemm.ee 8 points 2 months ago* (last edited 2 months ago) (1 children)

This seems to be blatant misinformation.
The default seems to require a gpg signature. It can be disabled for a remote with --no-gpg-verify, but the default for installing and building definitely requires a signature.
You keep talking about the docs, so please show me where is says that in the Flatpak Documentation.

[+] jagged_circle@feddit.nl -12 points 2 months ago* (last edited 2 months ago) (2 children)

[removed by mod]

[–] ms5K8oWx@programming.dev 8 points 2 months ago* (last edited 2 months ago) (1 children)

The burden of proof is on you.

You accused flatpak of being insecure. The burden to prove that is totally on you.

[–] MissingInteger@lemm.ee 8 points 2 months ago (1 children)

You have not provided a single link.

I'm am no expert on flatpak and just did some basic searching.
From reading the command reference it seems GPG-Verification is enabled for each remote and can't be disabled/enabled for each install. I can just find some issues where gpg verification fails

Error: GPG verification enabled, but no signatures found (use gpg-verify=false in remote config to disable)
error: Failed to install bundle fr.handbrake.ghb: GPG verification enabled, but no signatures found (use gpg-verify=false in remote config to disable)

Documentation seems to be more user oriented and not developer oriented maybe someone more knowledgeble can go in the source code and tell us how it actually works.