3 ms·
Well, looking at the procedure for Snap [1] there's no review at all. Flatpak [2] defers to Flathub [3] which has some sort of review: a pull request on Github
by cpburns2009 8y ago
Well, looking at the procedure for Snap [1] there's no review at all. Flatpak [2] defers to Flathub [3] which has some sort of review: a pull request on Github but I'm not sure how thorough that is. Traditional package repositories have a review phase before you can get your package into the system (that's how it is with Debian at least).
[1]: https://docs.snapcraft.io/build-snaps/upload https://docs.snapcraft.io/build-snaps/upload
[2]: http://docs.flatpak.org/en/latest/publishing.html http://docs.flatpak.org/en/latest/publishing.html
[3]: https://github.com/flathub/flathub/wiki/App-Submission https://github.com/flathub/flathub/wiki/App-Submission
- alkonaut 8y agoHow does that review work in the case of binary/proprietary packages?
- cpburns2009 8y agoI'm assuming you're talking about traditional package managers. Proprietary packages aren't uploaded to the main package repositories from what I've seen. The company will typically provide the packages themselves (e.g., a deb or rpm file), and sometimes they'll provide their own repositories for easier delivery. This has been my experience with Dropbox, SpiderOak, and Sublime Text.
- alkonaut 8y agoGot ya. They create their own repositories, and don't use the central one.
- TingPing 8y agoFlathub reviewer here. We do not security audit code of any project as thats just unreasonable. The user puts ultimate trust in the upstream projects we just ensure that the right upstream is used, libraries are up to date and sanely built, permissions are as reasonable as they can be, etc. This is identical to every traditional distro like Debian or Fedora.
- deadbunny 8y agoThe review is to get your access to publish, not the code submitted. So pass that, package honestly for 6 months, deploy malware.