5 ms·

Signal desktop is broken, since at least mid 2018. There is an open github issue, where the maintainers don't really respond: https://github.com/signalapp/Sig

by bpfrh 7y ago

Signal desktop is broken, since at least mid 2018. There is an open github issue, where the maintainers don't really respond: https://github.com/signalapp/Signal-Desktop/issues/2634 https://github.com/signalapp/Signal-Desktop/issues/2634 They statically link a openssl library for their forked version of sqlcipher, which makes it impossible to build signal on anything other than ubuntu. Static linking against an old openssl library is also not that good for security reasons, which imho is a bad sign if you say your chat programm stands for security and privacy. Edit: Link wrong, now corrected

DavideNL 7y ago
The url you posted doesn't work/point to a specific issue...
Kaze404 7y ago
Can you link to the specific issue? You linked to a search, not sure if by accident.
godelski 7y ago
> which makes it impossible to build signal on anything other than ubuntu. I've never had a problem on Arch or Manjaro
- bpfrh 7y ago
  You did a git clone and then a build without issue? Because the repo on arch patches the issue with the statically linked openssl library: https://aur.archlinux.org/cgit/aur.git/plain/openssl-linking.patch?h=signal https://aur.archlinux.org/cgit/aur.git/plain/openssl-linking... So if you just install signal from the aur, then you use the patched version.
  - godelski 7y ago
    Sorry, let me rephrase that. The AUR has a working patch so it clearly isn't impossible. You can probably follow the same procedure. So I just wouldn't say that it is impossible to install it on non-Ubuntu distros, just not trivial. But this seriously doesn't look complex. Also, wasn't Signal pushed into the main repos recently?
    - jedbrown 7y ago
      It's in community and uses this 2-line patch: https://git.archlinux.org/svntogit/community.git/tree/trunk/openssl-linking.patch?h=packages/signal-desktop https://git.archlinux.org/svntogit/community.git/tree/trunk/...
    - bpfrh 7y ago
      Of course you can replace the dependency, but do you know if it is 100% compatible? My point was that as long as the maintainers don't give us the reason for the static link or the custom dependency, we can assume we can replace it, but we don't know. Could be that it works, but it uses an insecure cipher, could be that there is a silent corruption. Nothing is impossible, just means you have to reedit and patch each time and know you running untested things for a secure application.
ufo 7y ago
One possible workaround for now might be to use the Flatpak version of Signal instead. I've been using it with no problems on Fedora.
- cmiles74 7y ago
  I believe I am using the Snap version on Solus and haven't had any issues.
- bpfrh 7y ago
  When I run a application for security reasons, I need to either built it myself, or have it build by official channels. I just hand edit the signal package.json each time I need an update, but I just don't understand why they won't update their dependency.

by bpfrh 7y ago

DavideNL 7y ago

The url you posted doesn't work/point to a specific issue...

Kaze404 7y ago

Can you link to the specific issue? You linked to a search, not sure if by accident.

godelski 7y ago

> which makes it impossible to build signal on anything other than ubuntu. I've never had a problem on Arch or Manjaro

bpfrh 7y ago
You did a git clone and then a build without issue? Because the repo on arch patches the issue with the statically linked openssl library: https://aur.archlinux.org/cgit/aur.git/plain/openssl-linking.patch?h=signal https://aur.archlinux.org/cgit/aur.git/plain/openssl-linking... So if you just install signal from the aur, then you use the patched version.
- godelski 7y ago
  Sorry, let me rephrase that. The AUR has a working patch so it clearly isn't impossible. You can probably follow the same procedure. So I just wouldn't say that it is impossible to install it on non-Ubuntu distros, just not trivial. But this seriously doesn't look complex. Also, wasn't Signal pushed into the main repos recently?
  - jedbrown 7y ago
    It's in community and uses this 2-line patch: https://git.archlinux.org/svntogit/community.git/tree/trunk/openssl-linking.patch?h=packages/signal-desktop https://git.archlinux.org/svntogit/community.git/tree/trunk/...
  - bpfrh 7y ago
    Of course you can replace the dependency, but do you know if it is 100% compatible? My point was that as long as the maintainers don't give us the reason for the static link or the custom dependency, we can assume we can replace it, but we don't know. Could be that it works, but it uses an insecure cipher, could be that there is a silent corruption. Nothing is impossible, just means you have to reedit and patch each time and know you running untested things for a secure application.

ufo 7y ago

One possible workaround for now might be to use the Flatpak version of Signal instead. I've been using it with no problems on Fedora.

cmiles74 7y ago
I believe I am using the Snap version on Solus and haven't had any issues.
bpfrh 7y ago
When I run a application for security reasons, I need to either built it myself, or have it build by official channels. I just hand edit the signal package.json each time I need an update, but I just don't understand why they won't update their dependency.